Security researchers have traced more than 1,500 infections of a malware family dubbed KREMLIN after uncovering a Brazilian banking campaign that uses Ethereum smart contracts as a dead-drop resolver to update attack infrastructure, pairing the technique with malicious browser extensions that steal credentials and session data.
Elastic Security Labs disclosed the operation in a September 14 technical report, having tracked the activity under the identifier REF9334 since May 2025. Over roughly fifteen months, researchers followed seven campaigns and linked the latest versions to Google Chrome and Microsoft Edge extensions capable of collecting browser credentials, cookies, session tokens and other sensitive information. SlowMist issued a threat-intelligence alert on September 16 drawing attention to the blockchain component, including three Ethereum contracts tied to rotating command-and-control infrastructure.
Not Russian, despite the name
Despite the toolkit’s name, Elastic found no evidence connecting the campaign to Russia. The moniker comes from the malware author’s handle, while the lures impersonate Brazilian banks, use Portuguese-language text and overwhelmingly reach systems located in Brazil. Of the 1,515 infected systems observed contacting Elastic’s registered canary domain, 98.75 percent were located in Brazil.
The campaign distributes JavaScript files disguised as bank receipts, invoices or corporate documents. Once a victim executes the lure, the loader checks the environment before proceeding to install the payload.
Ethereum as a changing address book
Ethereum entered the operation in May 2026, when researchers observed the first malicious smart contract tied to KREMLIN’s infrastructure. Elastic traced the earliest contract to May 19. It stored configuration values pointing infected systems toward locations used for the installer and the malicious browser extension. Later contracts changed the structure and eventually moved to a key-value configuration model that the operator could update at will.
The contract identified by Elastic as currently active is 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b, with earlier iterations at 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615.
Crucially, the contracts do not represent an exploit of Ethereum’s consensus system or its smart-contract platform. The attackers simply used the blockchain as a tamper-resistant, always-on data store: infected machines read configuration values from the contracts to locate external infrastructure controlled or abused by the operators. Because the blockchain is public and censorship-resistant by design, takedowns of individual command servers do not disrupt the operation, since the operator can update the on-chain pointers at any time while leaving the initial malware binary completely unchanged. Elastic recorded contract updates pointing toward different domains and hosted files, including a main-v2 configuration change on August 13.
Researchers traced 82 USDT transfers through the wallet used to deploy and update the malicious contracts, offering a rare on-chain financial trail for a traditionally opaque malware operation.
The phantom extension problem
KREMLIN’s browser component uses a technique that lets an unauthorized extension appear properly registered inside Chromium-based browsers. The installer modifies Chrome or Edge’s Secure Preferences data and regenerates the HMACs and encrypted integrity hashes the browser expects. Once those values match, the malicious extension loads even though the user never approved an installation through the official extension store.
The technique predates KREMLIN. Security firm Synacktiv documented the approach in 2025 under the research title “The Phantom Extension,” showing how an attacker with access to a Windows system could alter Chromium preference records and load an extension through internal browser mechanisms. KREMLIN operationalized that research for financial theft: Elastic’s analyzed extension masqueraded as software called AVSync and requested access to tabs, cookies, browser storage and web requests. It collected saved browser data, intercepted information during active web sessions, acquired the encryption material needed to unlock protected browser data, and forwarded everything to attacker-controlled infrastructure.
A growing pattern
The campaign is part of a broader trend of public blockchains being abused as malware infrastructure. ReversingLabs documented malicious npm packages using Ethereum smart contracts to retrieve command infrastructure in 2025, and Microsoft flagged ClickFix campaigns using BNB Chain smart contracts to fetch attack instructions in a separate operation. The pattern is attractive to operators for the same reasons enterprises like blockchains: availability, immutability and resistance to unilateral takedowns.
For defenders, the technique cuts both ways. While on-chain configuration makes infrastructure takedowns largely ineffective, it also makes the malware’s behavior observable and permanent. Every configuration update is a public transaction, and analytics firms can trace the funding wallets, as the 82 USDT transfers in this case demonstrate. Elastic recommended that organizations monitor for the known contract addresses, alert on any process touching Chromium Secure Preferences files, and treat unexpected extension installations as high-severity incidents.
For everyday users, the advice is more mundane but no less effective: treat unsolicited attachments and downloaded documents as untrusted, avoid executing JavaScript files received over email or messaging platforms, and periodically audit browser extensions for anything that was never deliberately installed.
Fifteen months of REF9334 tracking before Elastic went public, and the contract resolver means every takedown just rotates to new endpoints. SlowMist pushing the alert on the 16th is what gets people to check their extensions.
using an eth contract as a dead drop resolver is genuinely clever tradecraft. rotating C2 endpoints via onchain data means no hardcoded IPs to sinkhole
98.75 percent of infected systems were in Brazil and the lure is a fake bank receipt as a .js file. If your bank sends you JavaScript, maybe do not open it.
any bank that actually needs to send you a file uses a portal now. attachments were a tell ten years ago, people just never learn
right?? the .js attachment dressed as a bank receipt is such an obvious tell. the 1,500 people who opened it never had a chance though, it looked like an invoice
clever until someone deploys a watcher on the resolver contract. every rotation is an onchain event, you can flag new endpoints faster than the operators can migrate
watchers help the defenders who run them, the 1500 infected brazilians arent running dashboards tho. detection and prevention are different games
in theory yes but the rotation is one emit and the watcher is polling, alerts and a human on the other end. operator still wins that race most days
watching emits works until they rotate to a fresh deploy. three known contracts today, thirty tomorrow. still better than nothing tho
elastic tracked REF9334 since may 2025 and the public name only drops now. 15 months of campaigns, 1500+ infections, zero headlines. wild
using eth contracts as a dead drop resolver is genuinely clever. you cant seize the c2 list without forking the chain
@mev angle aside, 2FA does nothing when the extension eats your session tokens. hardware wallet users are fine, everyone else is exposed
hardware wallet yes but the extension also grabs passwords and session cookies. cold storage for keys plus a clean browser profile, both or nothing
hardware wallet saves the keys but the extension also scoops banking logins, cold storage doesnt fix that part. separate browser profile is the actual fix
this. one browser for banking, one for the degen stuff, nothing crosses over. took me ten minutes to set up and it kills half these campaigns on its own
clean browser profile for anything touching money is underrated advice. session cookies are the whole game once 2fa is bypassed
this is the part incident response has no answer for. sinkhole an IP and the contract just emits the next one onchain. playbooks were written for a world with servers
cant fork the chain but you can watch the contracts. slowmist listed three of them, anyone can monitor emits for the next endpoint rotation
1500 infections over 15 months is small for a banking trojan campaign. The scary part is the browser extension layer stealing session cookies
1500 is small because its spear phishing not spam. they picked the victims and probably netted more per infection than any botnet ever will
Extensions really are the weak link here. Session cookies bypass every 2FA flow. Everyone reading this should audit their chrome extensions tonight.
A bank receipt as a .js file, in Portuguese, and 98.75 percent of hits in Brazil. If your banco sends you JavaScript, that is not your banco.
eth contracts as the c2 resolver means the standard takedown playbook is useless. you would have to hardfork to kill the dead drop. genuinely clever tradecraft
hardfork to kill a dead drop is the wildest sentence. contract resolver as c2 is cheap too, emits cost cents per rotation
15 months of tracking before public disclosure because nobody watches brazilian bank lures. imagine this dead drop pattern pointed at seed phrase extensions instead of banking sessions
98.75 percent of hits in brazil and the lure is a fake bank document in portuguese. the social engineering lands because people there genuinely expect bank attachments