🚨 SlowMist TI Alert: KREMLIN Malware 🚨
This is a dev post classified by Jev as Security (news), kept by the Dev Radar because it carries real work, not commentary.
🚨 SlowMist TI Alert: KREMLIN Malware 🚨 Recently, a Brazilian banking malware operation, #REF9334, active since at least May 2025, was disclosed. 🔴 The #KREMLIN malware ecosystem uses multi-stage loaders and malicious browser extensions to steal credentials, session tokens, and sensitive data. ⚠️ Its malicious extensions can be installed in #Chrome and #Edge without user approval by bypassing Chromium integrity mechanisms, including Secure Preferences, HMACs, and App-Bound encrypted hashes. ⛓️ The operation also uses #Ethereum smart contracts as dead-drop resolvers to dynamically update C2
Posted by SlowMist (89.4k followers) 3 days ago · 24 likes · 4.1k views · view the original post on X. Kept by the Dev Radar as Security. Tools mentioned: labs-releases.
More dev work like this
- I just built the open-source version of this — @imarikchakma
- Security teams shouldn't have to wait for a critical vulnerability to trigger an… — @thenewstack
- Cloudflare just turned AI agents into SECURITY AUDITORS. — @tonysimons_
- Wow, these slides are fantastic to just read through and contemplate. 😍… — @zooko
- How hackers use SQL Injection to compromise a website — @Hamzaonchain
- Dostlar selamlar, globaldeki en büyük Cybersecurity SFT finetuning datasetlerinden olan… — @AlicanKiraz0
- Cloudflare 团队把其内部找漏洞的那套方法做成了一个 Skill，叫 security-audit，并开源了。 — @GitHub_Daily
- Practical Social Engineering: A Primer for the Ethical Hacker! #BigData #Analytics… — @gp_pulipaka
Every post is read and classified by Jev (TypeSafe): what it is, which market it belongs to, and whether the link is a real tool. 15.1k posts from 4.7k X accounts over the last 21 days, 1.7k tools, 12 markets. Collected every 5 minutes, fully re-ranked every hour — last update 2026-09-19 22:52 UTC. Full method.