KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and

Fact: The article describes a Brazilian banking malware campaign, KREMLIN, that uses fake bank lures and a malicious Chrome/Edge extension to steal banking credentials and session tokens from victims’ browsers. Fact: Elastic Security Labs tracks this activity as REF9334 and notes it has been active since at least May 2025, targeting users of multiple Brazilian banks. RealGround analysis: While the report does not mention AI directly, the malware’s ability to hijack browser sessions and harvest sensitive financial data highlights risks for fintech organizations increasingly integrating AI-driven banking assistants that rely on browser-based sessions and APIs. RealGround analysis: Fintech teams should treat this as a warning to harden identity, session management, and browser-integration surfaces around any AI-powered customer or employee banking tools, including enforcing strong device security baselines before exposing AI systems to live financial data.