# KREMLIN Malware Uses Ethereum Smart Contracts for Stealthy Attacks Brazilian banking malware bypasses Chrome and Edge security to steal credentials. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/64ef54ae-024b-4d3c-b225-176a4c5de457 ## Multi-stage malware delivery KREMLIN uses a JavaScript file disguised as banking documents to initiate attacks. The malware checks for sandbox environments before proceeding. It then downloads additional payloads, including a C++ installer that abuses SentinelOne binaries. The final payload impersonates legitimate DLL files to evade detection. This multi-stage approach ensures persistence and stealth. ## Ethereum smart contracts for C2 The malware uses Ethereum smart contracts to dynamically update command-and-control (C2) endpoints. This blockchain-based method conceals infrastructure and prevents disruption. The smart contracts host payload URLs and update them in real-time. This technique makes it harder for defenders to track and block malicious activities. ## Browser extension manipulation KREMLIN installs malicious extensions on Chromium-based browsers like Chrome and Edge. It bypasses integrity checks by modifying Secure Preferences files. The extension, named 'AVSync System Inc.', steals credentials and session tokens. It also exfiltrates browser data to a C2 server, including cookies and storage. ## Anti-sandbox mechanisms The malware performs hardware checks to evade virtual machines. It terminates if the system has less than 2 CPUs or 3 GB RAM. A network canary check detects sandbox environments by pinging unregistered domains. If a response is received, the malware crashes to avoid analysis. ## Victim targeting and impact Over 98% of infected systems are in Brazil. The malware impersonates Brazilian banks to lure victims. It harvests sensitive data, including browser tabs and cookies. Unique victim identifiers are stored in browser storage for tracking. ## Historical context and campaigns The threat actor has been active since May 2025. They transitioned to Ethereum smart contracts on May 19, 2026. Seven distinct campaigns have been attributed to the group. Previous activities included distributing Pulsar RAT and Remcos RAT. ## Defender challenges Elastic Security Labs identified 1,515 infected systems. The blockchain-based C2 infrastructure complicates takedowns. Malicious extensions bypass traditional security mechanisms. Defenders must monitor for unusual network activity and extension installations. ## Future implications The use of blockchain for malware C2 sets a dangerous precedent. Other threat actors may adopt similar techniques. Defenders need advanced tools to detect and block such attacks. Continuous monitoring and threat intelligence sharing are critical. ## Sources covering this story - https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._