**New Brazilian Banking Malware Leverages Blockchain and Browser Extensions to Steal Credentials**
Cybersecurity analysts have uncovered a sophisticated, previously undocumented malware operation originating from Brazil. This campaign, which has been active since at least May 2025, delivers a custom toolkit designed to target banking credentials and sensitive data by exploiting browser extensions on Google Chrome and Microsoft Edge.
The threat actors behind the operation have crafted lures that impersonate over a dozen Brazilian financial institutions to trick victims into manually executing a malicious JavaScript file. Once executed, the malware deploys a multi-stage loader that bypasses traditional security measures and installs a rogue browser extension capable of stealing credentials, session tokens, and other sensitive information.
A defining characteristic of this campaign is the attackers’ use of blockchain technology to conceal their command-and-control (C2) infrastructure. By utilizing Ethereum smart contracts as dead drop resolvers, the malware can dynamically update its C2 endpoints and payload hosting locations. This decentralized approach makes it exceptionally difficult for defenders and authorities to disrupt the network or take down the malicious servers.
The infection chain begins with a JavaScript file disguised as a banking or invoice document. When a victim runs it, the script initiates a multi-stage loader that includes robust sandbox and virtual machine evasion techniques. The loader checks the system’s hardware properties—such as CPU count and RAM capacity—and scans running processes. If the system has fewer than two CPUs, exceeds 3 GB of RAM, or matches a hard-coded list of security processes, the malware immediately terminates its execution to avoid analysis.
The second stage of the attack establishes persistence through a scheduled task and retrieves download locations from the Ethereum smart contract. From these locations, the malware downloads three key components: a malicious browser extension installer, a .NET PE Injector, and a legitimate binary associated with a cybersecurity product. The attackers abuse this legitimate binary through a technique known as DLL sideloading, injecting an unsigned payload that impersonates a core system component. Before launching the final browser extension, the malware performs the same evasion checks to ensure it is running on a genuine victim’s machine.
To install the extension on Chromium-based browsers without triggering security warnings, the attackers exploit a publicly documented integrity bypass technique. This method manipulates the browser’s Secure Preferences file, enables developer mode, and forges metadata to register the malicious add-on undetected.
Once the extension is active, it connects to its C2 server via a WebSocket channel and begins harvesting browser data. It requests extensive permissions to access tabs, cookies, storage, and the webRequest API. The extension can take screenshots of active tabs, steal cookies and local storage, extract the full HTML source of web pages, and collect browsing history. To hide its network traffic, the extension periodically mimics CSS file fetches by polling a “/google_api/” endpoint. Each specific path corresponds to a different command, such as uploading stolen cookies or downloading attacker-controlled web pages.
Defenders have had some success disrupting the campaign by registering a network canary domain that the malware uses to detect sandbox environments. If the malware receives a valid response from the domain, it assumes it is being analyzed and crashes. By registering the domain, researchers were able to identify over 1,500 infected systems, with more than 98% of those systems geolocated to Brazil.
***
**Frequently Asked Questions (FAQ)**
**Q: What type of malware is this?**
A: It is a banking malware operation that uses malicious browser extensions to steal credentials, session tokens, and sensitive data from users of Google Chrome and Microsoft Edge.
**Q: How does the malware get onto a victim’s computer?**
A: The initial infection starts with a JavaScript file that masquerades as a banking document, invoice, or company file. The victim must manually execute this file, which then triggers a multi-stage installation process.
**Q: Why do the attackers use Ethereum smart contracts?**
A: The attackers use Ethereum smart contracts as dead drop resolvers to hide their infrastructure. This allows them to dynamically update C2 endpoints and payload locations, making it extremely resilient against takedown attempts.
**Q: How does the malware hide from browser security features?**
A: The malware bypasses Chromium’s integrity mechanisms by modifying the browser’s Secure Preferences file and regenerating required security hashes. It also uses a technique called Phantom Extension to register the malicious add-on without triggering warnings.
**Q: What happens if the malware detects it is running in a sandbox?**
A: The malware performs various checks, including verifying system hardware and network connectivity. If it detects a sandbox or virtual machine environment, it deliberately crashes and terminates its execution to evade analysis.
***
**Conclusion**
The emergence of this Brazilian banking malware highlights the evolving tactics of cybercriminals who are combining social engineering, legitimate binary abuse, and decentralized blockchain infrastructure to maximize their operational resilience. By targeting the user’s browser directly through malicious extensions, the attackers bypass many traditional endpoint security measures. As this threat landscape continues to shift, both organizations and individuals must remain highly vigilant against unsolicited document downloads and unauthorized browser extensions, particularly when dealing with financial services.
Thank you for reading
