A Brazilian banking malware operation tracked by Elastic as REF9334 has infected at least 1,515 systems, with 98.75% located in Brazil. Active since at least May 2025, the KREMLIN ecosystem has appeared in seven campaigns using JavaScript lures, multi-stage loaders and malicious Chrome and Edge extensions to collect credentials, cookies, session tokens and other browser data. Ethereum smart contracts act as a dead-drop resolver, storing configuration values that direct infected machines to changing command-and-control infrastructure and payload locations without requiring changes to the malware. Elastic identified three related contracts and 82 USDT transfers involving the wallet used to deploy and update them. The researchers temporarily registered a domain used in KREMLIN's anti-analysis check, causing infected systems to stop progressing while confirming the campaign's reach. Elastic said it found no evidence linking the operation to Russia despite its name.