KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users. New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration. KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction. The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on. Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP. Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign. The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

We uncovered a new Brazilian banking trojan campaign: TCLBANKER. What makes TCLBANKER notable isn’t just the malware itself, but how it spreads. The campaign uses compromised WhatsApp and Outlook accounts to propagate through trusted user relationships, deploys targeted banking overlays, and incorporates anti-analysis techniques designed to evade detection. For defenders, it’s another example of malware increasingly blending into legitimate user behavior and everyday communication channels, making detection harder and trust easier to exploit. Our latest research breaks down the infection chain, propagation methods, evasion tactics, and detection opportunities observed across the campaign. Read the full analysis: go.es.io/4ewvCKF

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

New from the developer of #FINALDRAFT: Meet #NANOREMOTE, a newly-discovered Windows backdoor that leverages the Google Drive API for data theft and payload staging. Get the full analysis and defense strategies: ela.st/nanoremote

#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at ela.st/roningloader

#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys: go.es.io/3L68p57

We’re exposing a newly discovered #malware family that has made its home on #GitHub. SHELBY targeted a middle east telecom company, uses GH commits for C2, and shares hard-coded tokens for authentication. Read the malware and campaign breakdown: go.es.io/3DXE8Cv

Join @cyril_t_f and #ElasticSecurityLabs in exposing ABYSSWORKER, a malicious driver that silences #EDR tools and is distributed via the MEDUSA #ransomware. Get the deep details: go.es.io/4bFKnr5

You’ve learned about the malware, but what about the story behind it? Explore the twists and turns of REF7707 — an adversary campaign that spans the globe: go.es.io/41eeeTY #ElasticSecurityLabs #cybersecurity #cyberattack

We’re adding a new section to @elastic’s HackerOne Bounty Program! Today, we’re opening our SIEM and EDR rules for testing. We’re excited to have another way to thank our community for their efforts on our #detectionengineering. Get more details here: go.es.io/4hdKQCI

#ElasticSecurityLabs is exposing Banshee Stealer — a brand new macOS infostealer with ties to browsers and cryptocurrency. This MaaS collects an immense amount of data, but you can get the details and protections here: go.es.io/3YNQeWY #malware #cryptocurrency #macos

#ElasticSecurityLabs is exposing a new threat technique — a fresh application of MMC abuse. GRIMRESOURCE utilizes specially crafted MSC files for full code execution. Read through the breakdown from @dez_ and @SBousseaden : go.es.io/45AO0eG #threattechnique #cybersecurity

Today, #ElasticSecurityLabs is exposing WARMCOOKIE, a new backdoor that’s been utilized by threat actors posing as job recruiters. Grab a glass of milk and check out the details: go.es.io/4cfl1iN #malware #new #cybersecurity

Today, we’re unveiling an intrusion set focused on cryptomining with a new payload: GHOSTENGINE. REF4578 utilizes multiple malicious modules and BYOVD. Get the details: go.es.io/3ytg3QV #ElasticSecurityLabs #malware #cryptocurrency

We’ve observed a recent uptick in LATRODECTUS, a malware loader with ties to ICEDID. This brand new article breaks down the details and highlights protections. Check it out: go.es.io/4bFp1Zo #ElasticSecurityLabs #malware

.@SBousseaden‘s new article explores recent Windows zero-day attacks by analyzing in-the-wild LPE examples and outlining detections that can be run in Elastic Security. Check out the three cases: CLFS, DWM, and Activation Context: go.es.io/43vV8rC #ElasticSecurityLabs

Devin, the AI software engineer leaks API keys in source code it writes in the first 5 seconds of its demo.

#ElasticSecurityLabs researchers @soolidsnakee and @DanielStepanic share new details about an emerging #PikaBot campaign using obfuscation to evade defenses and deploy a variety of malware payloads. Read more at elastic.co/security-labs/pik…

There’s a brand new tool from #ElasticSecurityLabs! Check out the STIX to ECS converter from @andythevariable and @cyril_t_f: go.es.io/3HC1UlB #codeconverter

The DPRK was so excited about Halloween, they got a head start on passing out candy. Check out REF7001, AKA KANDYKORN – a malware distributed in cryptocurrency servers on Discord: go.es.io/46Q4Lm3 #malware #threatdiscovery #cryptocurrency #discord #ElasticSecurityLabs

Who you gonna call? Elastic Security Labs has discovered GHOSTPULSE, a stealth loader that utilizes MSIX. Get all the details here → go.es.io/3FAX9YI #ElasticSecurityLabs #malware #threatdetection

Check out BLOODALCHEMY, the new malware discovered by Elastic Security Labs. We believe this backdoor is in active development. Learn more: go.es.io/3Ffdy4Q #malware #ElasticSecurityLabs

What are EAGERBEE, RUDEBIRD, and DOWNTOWN? Check out the new SIESTAGRAPH related #malware discoveries from #ElasticSecurityLabs: go.es.io/46gqrHA

#ElasticSecurityLabs has identified a new variant of the RUSTBUCKET malware. Check out the details and review our rules for identification here: go.es.io/3Np5Qsw

The new campaign article on JOKERSPY aims to help you understand the recently discovered intrusion around REF9134. See how #ElasticSecurityLabs identified the adversary’s movements: go.es.io/3NDh3Hh

#ElasticSecurityLabs is tracking a threat targeting Vietnamese Agriculture and Financial industries. We’ll share their TTPs with emphasis on newly-discovered #Malware, and tell you who we think is behind it. Check out the latest here: go.es.io/3ChNch8

#ElasticSecurityLabs highlights a new #Malware family we call LOBSHOT, deployed as part of a Google adwords malvertising campaign. Read more about this financially-motivated threat here: go.es.io/41FRzxu

Custom 'Naplistener' Malware a Nightmare for Network-Based Detection: bit.ly/404OmH3 by Elizabeth Montalbano