KREMLIN Malware Uses Ethereum Smart Contracts for Stealthy Attacks
Brazilian banking malware bypasses Chrome and Edge security to steal credentials.
1Multi-stage malware delivery
KREMLIN uses a JavaScript file disguised as banking documents to initiate attacks. The malware checks for sandbox environments before proceeding. It then downloads additional payloads, including a C++ installer that abuses SentinelOne binaries. The final payload impersonates legitimate DLL files to evade detection. This multi-stage approach ensures persistence and stealth.
2Ethereum smart contracts for C2
The malware uses Ethereum smart contracts to dynamically update command-and-control (C2) endpoints. This blockchain-based method conceals infrastructure and prevents disruption. The smart contracts host payload URLs and update them in real-time. This technique makes it harder for defenders to track and block malicious activities.
3Browser extension manipulation
KREMLIN installs malicious extensions on Chromium-based browsers like Chrome and Edge. It bypasses integrity checks by modifying Secure Preferences files. The extension, named 'AVSync System Inc.', steals credentials and session tokens. It also exfiltrates browser data to a C2 server, including cookies and storage.
4Anti-sandbox mechanisms
The malware performs hardware checks to evade virtual machines. It terminates if the system has less than 2 CPUs or 3 GB RAM. A network canary check detects sandbox environments by pinging unregistered domains. If a response is received, the malware crashes to avoid analysis.
5Victim targeting and impact
Over 98% of infected systems are in Brazil. The malware impersonates Brazilian banks to lure victims. It harvests sensitive data, including browser tabs and cookies. Unique victim identifiers are stored in browser storage for tracking.
6Historical context and campaigns
The threat actor has been active since May 2025. They transitioned to Ethereum smart contracts on May 19, 2026. Seven distinct campaigns have been attributed to the group. Previous activities included distributing Pulsar RAT and Remcos RAT.
7Defender challenges
Elastic Security Labs identified 1,515 infected systems. The blockchain-based C2 infrastructure complicates takedowns. Malicious extensions bypass traditional security mechanisms. Defenders must monitor for unusual network activity and extension installations.
8Future implications
The use of blockchain for malware C2 sets a dangerous precedent. Other threat actors may adopt similar techniques. Defenders need advanced tools to detect and block such attacks. Continuous monitoring and threat intelligence sharing are critical.