Brazilian Bank Malware Updates Addresses via Ethereum Smart Contracts

Kremlin malware has been analyzed for updating its attack infrastructure and malicious code download addresses through Ethereum smart contracts. SlowMist disclosed this malware case. Kremlin targets Brazilian banks by installing malicious extensions on Chrome and Edge browsers to steal login information and session tokens. Elastic Security Labs reported in an official report that related activities have continued since at least May 2025, with seven campaigns identified over a 15-month period. The firm explained that Kremlin maintains infection through scheduled tasks before retrieving payloads and command-and-control (C2) infrastructure addresses from Ethereum smart contracts. Attackers can update the attack infrastructure without redistributing the initial malware by modifying addresses stored in the smart contract.