KREMLIN malware uses Ethereum to update attack servers

Security researchers have traced more than 1,500 KREMLIN malware infections after uncovering a Brazilian banking campaign that uses Ethereum smart contracts to update attack infrastructure and malicious browser extensions to steal credentials and session data.

Elastic Security Labs disclosed the operation in a Sept. 14 technical report after tracking the activity under REF9334 since May 2025. Researchers followed seven campaigns over roughly 15 months and linked the latest versions to Chrome and Microsoft Edge extensions capable of collecting browser credentials, cookies, session tokens and other sensitive information.

SlowMist issued a threat-intelligence alert on Sept. 16 drawing attention to the blockchain component of the operation, including three Ethereum contracts linked to changing command-and-control infrastructure.

Despite the name KREMLIN, Elastic said it found no evidence connecting the campaign to Russia. The toolkit name comes from the malware author’s handle, while the lures impersonate Brazilian banks, use Portuguese-language text and overwhelmingly reach systems located in Brazil.

KREMLIN uses Ethereum contracts as changing address books

Ethereum entered the operation in May 2026, when researchers observed the first malicious smart contract tied to KREMLIN’s infrastructure.