Reported by 4 outlets

Timeline

1. original reporting

   KREMLIN Malware Installs Chrome Extensions Users Never Approved to Steal Banking Data

   cyberpress.org · 27d ago · September 16th, 2026

   Security researchers have uncovered a Brazilian banking-malware operation named KREMLIN that secretly installs malicious extensions in Google Chrome and Microsoft Edge . The malware bypasses Chromium’s built-in extension integrity protections, making the browser load the extension as if the victim had installed and approved it. Elastic Security Labs tracks the activity as REF9334 and says the operation has been active since at least May 2025. Despite its name, the threat is not believed to be Russian. Its lures, error messages, code comments, and bank impersonation themes are written in Portuguese, while its campaigns overwhelmingly target Brazilian banking users. KREMLIN Silently Hijacks Chrome The attack starts with a malicious JavaScript file disguised as a banking receipt, invoice, company document, or payment-related file. Victims are tricked into manually opening the file, which may display a fake error message to make it appear that the document failed to load. Loader file VirusTotal detection (Source: elastic) Behind the scenes, the JavaScript loader checks whether it is running inside a virtual machine or security sandbox. It counts files on the desktop and active processes, stopping execution if the computer appears to be an analysis environment. If the device passes these checks, the malware downloads Node.js and additional payloads. It also creates a scheduled task named “MicrosoftNodeRuntimeUpdater,” which is designed to look legitimate. The task runs after the v

2. update from gbhackers.com

   KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

   gbhackers.com · 27d ago · September 16th, 2026

   Despite its name, the KREMLIN toolkit shows no apparent Russian connection. The campaign relies on Portuguese-language artifacts, lures impersonating 12 Brazilian banks, and […] The post KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from www.redhotcyber.com

   The hacker asked Revolut for user data, and Revolut handed it over

   www.redhotcyber.com · 27d ago · September 16th, 2026

   The hacker asked Revolut for user data. And Revolut handed it over. Fintech company Revolut has confirmed a data breach caused by attackers who sent fake government requests via email. Because the emails came from a legitimate government domain, Revolut employees treated them as authentic and disclosed the requested information. According to TechCrunch, which obtained Revolut's breach notification, the disclosed data included dates of birth, postal and email addresses, phone numbers, and copies of identity documents including passports and driver's licenses. The attackers may also have obtained selfies used for identity verification, bank statements, and transaction history. Revolut said the incident affected a "limited" number of customers and all affected users were contacted directly. The company stated that its internal systems were not compromised and customer funds remain secure. Blockchain analyst ZachXBT published Revolut's notification and suggested the attackers specifically targeted high-net-worth users. Revolut currently serves over 80 million customers worldwide and holds banking licenses in more than 30 countries. via Mastodon https://www.redhotcyber.com/post/lhacker-chiede-i-dati-a-revolut-e-revolut-glieli-consegna/

4. update from www.clubic.com

   KREMLIN banking malware hijacks Chrome sessions to steal credentials

   www.clubic.com · 27d ago · September 16th, 2026

   The malware installs a rogue extension on Chrome and Edge by bypassing Chromium's integrity checks, then harvests cookies, passwords, and session tokens. Once executed, KREMLIN's loader checks for sandbox environments, downloads a Node.js runtime, then installs a C++ program that loads its main payload via a signed SentinelOne binary. The final step installs an extension directly into the victim's Chrome and Edge profiles, bypassing the Chrome Web Store entirely. To install the extension without triggering alerts, KREMLIN regenerates the cryptographic hashes Chromium uses to verify that no extension has been added without user consent. Elastic Security Labs tracked this activity (designated REF9334) over fifteen months across seven campaigns. The extension connects to a command server via WebSocket, polling every second for instructions including screenshots, tab enumeration, cookie and local storage theft, or full page source extraction. Despite the "Kremlin" name, the author has no established ties to Russia. An Ethereum wallet associated with KREMLIN deployment recorded 82 transfers between June 2025 and August 2026, with transaction times matching São Paulo business hours. Over 1,500 infected systems attempted to connect to a sinkhole domain, with 98.75% located in Brazil, confirming the campaign's regional focus on Brazilian banking customers. via Mastodon https://www.clubic.com/actualite-629875-ce-malware-bancaire-russe-detourne-chrome-pour-voler-vos-sessions.html