@soolidsnakee
@k33b0i and myself will be presenting today at @virusbtn 2026 in Seville on a cool research around SEO poisoning !View quoted post on X
#vb2026 #threat #malware
571 IIS servers hijacked using machine keys from public docs.
@soolidsnakee and @k33b0i break down REF3927 at @virusbtn VB2026
• Today, 15:00 CEST in the Green room.
Talk abstract and kill chain outline: go.es.io/3Us9kSw
Full blog: go.es.io/4hZ5TKGView quoted post on X
KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users.
New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable
The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration.
KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction.
The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on.
Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP.
Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign.
The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.View quoted post on X
Hijacked YouTube channels are pushing an emerging infostealer.
We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains.
The stealer itself is built for long-term operation:
- Sandbox scoring: 10 weighted checks, self-terminates at a score of 7+
- App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control
- EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary
- Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets
- 4,700 related samples hit VirusTotal in the past year.
Our team observed 4 follow-on modules that haven't been publicly documented until now.
Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic:
Blog: go.es.io/4iJZRQe
Whitepaper: go.es.io/4xcanmZView quoted post on X
