> TritonInfoSec News
Home / Sep 16, 2026 / Story
0
#10 The Hacker News general September 15, 2026 at 18:54 UTC

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

By [email protected] (The Hacker News)

AI Summary

Elastic Security Labs identified a Brazilian banking malware operation tracked as REF9334, active since at least May 2025, delivering a toolkit called KREMLIN that installs malicious browser extensions on Google Chrome and Microsoft Edge to steal credentials and session tokens from users of approximately a dozen Brazilian banks. The MaaS-style operation's use of browser extension hijacking to bypass credential protections represents a growing threat vector for financial sector defenders in Latin America and beyond.

Read full article → https://thehackernews.com/2026/09/kremlin-banking-…

Relevance score: 80.0/100

# More from September 16

  1. 1
    Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution The Hacker News
  2. 2
    Cisco patches Secure Email Gateway zero-day exploited in attacks BleepingComputer
  3. 3
    CISA: Critical VMware RCE flaw now exploited by ransomware gangs BleepingComputer
  4. 4
    China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE The Hacker News
  5. 5
    Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases SecurityWeek
  6. 6
    Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists The Hacker News
  7. 7
    Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites BleepingComputer
  8. 8
    Japan's Digital Agency says VPN flaw exposed 246,000 personnel records BleepingComputer
  9. 9
    Cisco warns customers of actively exploited zero-day in email gateways CyberScoop