Brazilian Banking Malware Campaign REF9334 Uses Ethereum Smart Contracts to Update C2 Endpoints

A Brazilian banking malware campaign tracked as REF9334 has been disclosed after being active since at least May 2025. According to ChainCatcher, the KREMLIN malware ecosystem uses multi-stage loaders and malicious browser extensions to steal credentials, session tokens, and sensitive data. The malicious extensions can be installed in Chrome and Edge without user approval by bypassing Chromium integrity protections, including Secure Preferences, HMAC, and App-Bound encryption hashes. The campaign also uses Ethereum smart contracts as dead-drop resolvers to dynamically update C2 endpoints and payload hosting locations. After registering network Canary domains, analysts observed 1,515 infected hosts checking in, with 98.75% located in Brazil. SlowMist advised security teams to monitor the malware, browser extension activity, and infrastructure linked to the campaign.