KREMLIN Banking Malware Hijacks Chrome and Edge for Credentials

Researchers have uncovered a previously undocumented Brazilian banking malware operation delivering a toolkit named KREMLIN. Tracked as REF9334, the campaign uses lures mimicking major financial institutions to install malicious browser extensions on Google Chrome and Microsoft Edge. The primary objective is to harvest sensitive user credentials and active session tokens.