{
  "id": 7764515,
  "title": "Chrome and Edge browsers hijacked by KREMLIN malware for credential and token session theft",
  "url": "https://urgent.news/2026/09/16/chrome-and-edge-browsers-hijacked-by-kremlin-malware-for-credential",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-16T10:05:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/chrome-and-edge-browsers-hijacked-by-kremlin-malware-for-credential-and-token-session-theft"
  },
  "original_language": "en",
  "account": "Elastic Security Labs has uncovered a new Brazilian banking malware campaign dubbed REF9334, which has been active since May 2025. The malware, known as \"Kremlin,\" utilizes fake banking, invoice, and business documents to deceive users into installing malicious extensions in Chrome and Edge browsers. The primary objective of the campaign is to target Brazilian bank users and steal sensitive information, such as browser credentials, cookies, session data, and monitor user activity. To evade detection, the malware checks for sandbox environments and deploys a deceptive extension named \"AVSync System Inc.\" if it detects a real user's computer. The campaign stores data on the Ethereum blockchain, making it difficult to disrupt communication between the operators and infected machines. Elastic researchers managed to take control of a domain used by the malware and discovered that it had infected 1,515 systems, with nearly all (98%) located in Brazil. The investigation revealed that the infections had not progressed beyond the initial access stage.",
  "summary": "The KREMLIN malware has nothing to do with Russia - it is a Brazilian campaign.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}