A new malware campaign called Fakext is using malicious browser extensions to steal credentials and install remote access tools on victims' devices. The campaign is primarily targeting banks in Latin America. The malware uses man-in-the-browser attacks and web injections to steal input fields and display fake pages prompting victims to download remote access tools. Technical analysis shows the malware uses evasive techniques like domain spoofing and anti-debugging methods.