Elastic Security Labs registered a network canary and found 1,515 infected systems attempting to check in — more than 98% geolocated to Brazil.
The KREMLIN toolkit and its multi-stage loaders
Researchers Cyril François and Andrew Pease, writing in a technical report shared with The Hacker News, say the KREMLIN operation has been active since at least May 2025 and comprises a multi-stage JavaScript loader, a custom C++ installer, and a malicious browser extension. The compromise begins when a victim manually executes a JavaScript file that masquerades as a banking, invoice, or company document. That loader performs sandbox and virtual-machine detection, then proceeds only if those checks pass.
The second stage establishes persistence with a scheduled task, fetches download locations from an Ethereum smart contract, retrieves binaries from those locations and executes a third-stage payload. The payloads hosted at those URLs include a malicious browser extension installer, a .NET PE injector, and a file named SentinelMemoryScanner.exe — a legitimate binary that KREMLIN abuses for DLL sideloading.
SentinelOne binary sideloading and anti-analysis checks
The C++ installer leverages the SentinelMemoryScanner.exe binary to sideload an unsigned payload impersonating "SentinelAgentCore.dll." That DLL repeats the loader’s anti-sandbox checks: it scans running processes and inspects hardware properties. If a process on a hard-coded list is present, or if the machine reports fewer than 2 CPUs or 3 GB of RAM, the malware terminates. The malware also performs a network canary check by attempting to download a page from an unregistered domain; if the download returns a valid response — indicative of some sandbox simulations — the malware intentionally crashes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleBrowser extension stealth, privileges, and command set
The operation installs a Chromium extension named "AVSync System Inc." with ID "ndpbidppejfanjbhfgjlohfanbfbklff" and version "1.0.0." Before downloading it, KREMLIN checks whether the extension exists locally and compares versions. The installer downloads the extension as a ZIP archive and bypasses Chromium integrity protections using a publicly documented technique called Phantom Extension and GhostChrome-X: it modifies Chrome’s Secure Preferences, enables developer mode, and forges the "protection.macs" metadata to register the malicious extension.
Once active, the extension requests broad access — tabs, cookies, storage and the webRequest API — and establishes a WebSocket channel to its command-and-control server at "luizestrelhashapr[.]online:443." The extension generates a unique victim identifier stored in browser storage and supports commands to capture screenshots, enumerate and upload tabs/domains, steal cookies and session/local storage, extract full-page HTML, deliver attacker-controlled HTML, and refresh configuration. It also attempts to collect up to 1,000 history entries from the previous 15 days — a step the researchers assess will likely fail because the extension manifest lacks the history permission.
Ethereum smart contracts and C2 hiding
A defining trait of the operation is its use of Ethereum smart contracts as dead-drop resolvers: KREMLIN queries smart contracts to retrieve domains and payload locations so the actors can dynamically update command-and-control endpoints and hosting without touching conventional infrastructure. Elastic’s timeline indicates the group transitioned to Ethereum smart contracts on May 19, 2026, and has run seven distinct campaigns since June 16, 2025. The smart-contract mechanism is tied to the second-stage behavior that fetches two domains — volmira[.]site and zaviro[.]online — with volmira returning the extension version and ID.
In parallel with WebSocket commands, the extension polls a "/google_api/" path and fetches CSS-masquerading endpoints mapped to actions. Examples include 108766d0.css to upload cookies and storage, 41f7b187.css to upload tab IDs and domains, b83fa72d.css to upload compressed browser history, 0f51ad2f.css to upload screenshots, and others mapped to HTML exfiltration, intercepted requests, and configuration or redirection rules.
What this means for security teams, Brazilian banks, and browser/endpoint vendors
- Security teams and incident responders: watch for scheduled tasks that persist loaders, unexpected use of SentinelMemoryScanner.exe for DLL loading, the extension ID "ndpbidppejfanjbhfgjlohfanbfbklff", and outbound connections to luizestrelhashapr[.]online:443 or the domains volmira[.]site and zaviro[.]online. Elastic’s registration of the network canary temporarily degraded the campaign’s defense mechanisms and identified 1,515 infected endpoints — a concrete example of defenders gaining telemetry by registering abused domains.
- Brazilian banks and affected customers: the operation uses lures impersonating a dozen Brazilian banks to prompt manual execution of the initial JavaScript. The extension’s capabilities — cookie and storage theft, HTML capture and full-page exfiltration — place web session tokens and credentials at risk for customers who install the extension or execute the staged payloads.
- Browser and endpoint vendors: the attackers exploit a known Chromium integrity bypass (Phantom Extension/GhostChrome-X) and a legitimate SentinelOne binary for DLL sideloading. Those specific techniques and artifacts are direct signals for product owners to detect anomalous modification of Secure Preferences files, forged "protection.macs" entries, or unauthorized use of SentinelMemoryScanner.exe in launch chains.
"The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data," François and Pease write — a concise summary of a campaign that pairs old tricks (social-engineered JavaScript and DLL sideloading) with a relatively new twist (blockchain-based dead drops).
Elastic’s action — registering the network canary and observing thousands of check-ins concentrated in Brazil — shows defenders can still disrupt parts of a campaign’s playbook. The persistent reliance on browser-extension abuse and on-chain resolvers, however, leaves open the question the report itself highlights: how will defenders detect and block dynamic, blockchain-driven infrastructure that never appears in a conventional domain blacklist?
