Overview
- Security teams disclosed the operation in a Sept. 14 technical report that traced the campaign, tracked as REF9334 or KREMLIN, to activity beginning in May 2025.
- Infected users are tricked into running JavaScript or document lures that start multi‑stage loaders which then drop a malicious extension into Chrome or Edge.
- The malware alters Chromium Secure Preferences and regenerates browser integrity hashes so extensions load without user approval and can harvest cookies, saved credentials, session tokens and page data.
- Operators store configuration values in Ethereum smart contracts so infected machines read on‑chain data to find new payloads and command servers, and researchers found the active contract remained usable when the report was published.
- Elastic temporarily disrupted the campaign by registering an unused canary domain and counted about 1,515 infected hosts, mostly in Brazil, but the intervention did not remove the malware so endpoint hunts, credential resets and the published IOCs are needed to clean systems.