Brazilian KREMLIN Banking Malware Deploys Malicious Browser Extensions to Harvest Credentials

Security researchers have documented a banking malware campaign originating from Brazil known as KREMLIN, tracked by Elastic Security Labs under…

Users in Brazil should exercise caution with emails and downloads purporting to come from banking institutions. IT teams should review browser extension installation policies, consider restrictions via GPO/MDM, and monitor KREMLIN-associated indicators as they become available. Validating the integrity of installed browser extensions is advisable.