Loading malware…
Remus is a Windows information stealer marketed through a malware-as-a-service affiliate model and observed in underground markets in early 2026. Affiliates generate customized payloads with campaign identifiers and operate separate delivery infrastructure. Remus targets browser passwords, cookies, authenticated session tokens, encryption keys, cryptocurrency-wallet data, password-manager data, and local files. It also collects clipboard contents, screenshots, system information, and data from remote-access, VPN, messaging, cloud, and file-transfer applications. Newer versions collect AI-assistant and coding-tool credentials, API tokens, configuration data, and usage histories. Stolen cookies and tokens can enable access to authenticated accounts without repeating password and multifactor-authentication challenges.
Remus is distributed through ClickFix fake-CAPTCHA lures, cracked-software bundles, and trojanized game installers. ClickFix campaigns use malicious advertisements, email, or compromised websites to persuade victims to execute commands. Observed delivery chains include PLYCHIP staging, DonutLoader shellcode, GoFlateLoader, and 2CLoader. Some chains execute the stealer entirely in memory.
Remus uses browser-process injection to recover protected browser data. Its evasion mechanisms include Obfuscator-LLVM-based obfuscation, an encrypted in-memory system-call reference table, system-call hook removal, syscall riding, and sandbox checks. It uses Windows COM objects to profile systems and resolve shortcuts to files selected for theft. Remus has technical overlaps with Lumma Stealer, including obfuscation characteristics and Chromium credential-recovery techniques.
Embedded command-and-control configuration and exfiltrated data are protected with ChaCha20. Stolen information is transmitted through staged HTTP POST requests, allowing partial collection to succeed if execution is interrupted. Higher subscription tiers support EtherHiding, which retrieves replacement command-and-control locations from Ethereum smart contracts when embedded infrastructure is unavailable.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The loader then uses process hollowing to place the Remus stealer inside ServiceModelReg.exe.
60 distinct techniques documented for this family, organized by ATT&CK tactic.
“Victims encounter a fake CAPTCHA through email, malicious advertising, or a compromised website.”
SEO poisoning, aimed at achieving top search engine rankings, was used, and file-hosting services, cloud storage platforms, Mega, and Mediafire were identified as the primary distribution sites.
The attack begins with a ClickFix lure -- a social engineering technique that presents victims with a fake "I Am Not a Robot" verification page.
“Victims encounter a fake CAPTCHA through email, malicious advertising, or a compromised website.”
OLE32.dll functions (CoCreateInstance, CoInitialize, CoSetProxyBlanket) indicate WMI-based system profiling through COM interfaces.
Targeted pivoting on one-verif[.]lol ... yielded several PowerShell samples ... [that] confirmed the Remus payload was decrypted and executed entirely within the PowerShell process's own memory.
The sample also carried the syscall.Syscall execution transfer abuse by pointing to the Remus payload's entry point.
The ClickFix clipboard-hijack JavaScript ... writes [a] command to the victim's clipboard ... [and] directs victims to one-verif[.]lol.
“The infection commonly begins with ClickFix social engineering. Victims encounter a fake CAPTCHA through email, malicious advertising, or a compromised website, then are persuaded to run a command themselves.”
“The stealer also uses generic Windows COM objects to profile a device, follow shortcuts, and obtain files.”
Remus targets Chromium and Firefox browser credentials, cookies, and master keys via browser-process injection.
Then the loader uses process hollowing to inject the Remus information stealer into another signed binary, ServiceModelReg.exe.
Furthermore, both Remus and Lumma also employ SYSTEM token impersonation as an alternative method to bypass ABE.
Remus payloads protect their embedded C2 configuration with the ChaCha20 encryption algorithm.
The threat actors append data beyond the PE's default section table with null or random bytes to artificially inflate the size of the file, also known as a 'PE overlay.'
One of the first things both do upon execution is that they enumerate all Nt-prefixed exports from ntdll.dll and build a lookup table mapping their name hashes to the corresponding Syscall Service Numbers (SSNs).
The report includes cases involving disguising as cracks and keygens... Statistics on companies disguised by new malware... were extracted based on version and certificate information.
Remus targets Chromium and Firefox browser credentials, cookies, and master keys via browser-process injection.
Then the loader uses process hollowing to inject the Remus information stealer into another signed binary, ServiceModelReg.exe.
Furthermore, both Remus and Lumma also employ SYSTEM token impersonation as an alternative method to bypass ABE.
“[Remus] keeps [system-call numbers] in a reference table that it decrypts in memory during setup.”
SockS5 proxy integration, antivirtualization controls, gaming-platform targeting, as well as deeper password harvesting were all added to the malware.
“Remus checks Outlook storage for a file named honey@pot.com.pst as a simple sandbox test, then can avoid running in an analysis environment.”
If injection into an existing browser process fails, Remus launches a hidden browser on a separate desktop, invisible to the user.
Each blob carries an encrypted Remus PE, decrypts it at runtime, and maps it into memory with the PE header zeroed.
“Before doing so, it scans for and removes hooks on these calls, interfering with a common way endpoint detection and response tools watch programs for suspicious behavior.”
"[The Ledger Live replacement] will allow our clients to generate even more seed phrases."
“Like a session token, a valid JWT may grant direct account access... [and] bypasses regular authentication using a username and password and also bypasses MFA challenges.”
Remus prioritizes stealing authenticated browser sessions to bypass multi-factor authentication (MFA).
“The malware can also gather data from remote access, VPN, cloud, messaging, and file-transfer applications.”
Some agents keep access tokens or refresh tokens locally... MCP configurations... may hold endpoints, headers, environment variables, API keys, or other authentication details for external tools.
“[Remus] is built to collect browser information, cryptocurrency wallet data, passwords, and files from compromised computers.”
The final payloads GoFlateLoader delivers are all information stealers, programs designed to quietly harvest saved passwords, browser data, and cryptocurrency wallet credentials from infected machines.
From there, it can access browser vaults directly, harvesting saved passwords, session cookies, and sensitive data that would normally be locked behind encryption on disk.
Remus targets Chromium and Firefox browser credentials, cookies, and master keys.
This objective was further reinforced by repeated targeting of Discord, Steam, Riot Games, and Telegram environments... As of April 2026, the operator has implemented collection capabilities associated with Bitwarden, 1Password, LastPass, and IndexedDB-based browser storage mechanisms commonly used to retain locally authenticated data...
“Remus also has the ability to steal data from registry entries in order to gather additional information about victim software installations.”
“The stealer also uses generic Windows COM objects to profile a device.”
Open-source reporting ... indicates Remus targets ... file-system search.
ADVAPI32.dll provides GetUserNameA for user enumeration.
April marked another strategic transition in REMUS's evolution, this time toward authentication-based session persistence and browser-side artifact collection... It also included IndexedDB extractions linked to browser extensions associated with the 1Password and LastPass browser extensions...
SockS5 proxy integration, antivirtualization controls, gaming-platform targeting, as well as deeper password harvesting were all added to the malware.
“Remus checks Outlook storage for a file named honey@pot.com.pst as a simple sandbox test, then can avoid running in an analysis environment.”
“Some of this information, such as antivirus product information, is gathered using COM objects.”
“[Remus] follow[s] shortcuts, and obtain[s] files” and “gather[s] data ... alongside files reached through Windows shortcuts.”
"[The Ledger Live replacement] will allow our clients to generate even more seed phrases."
Open-source reporting ... indicates Remus targets ... screenshots.
Open-source reporting ... indicates Remus targets ... clipboard content.
“For each .lnk file found, the file is loaded… the referenced file is resolved, and then the path is passed to the file stealer function for file theft.”
The malware also forges the HTTP Host header to mimic a major technology vendor, which helps outbound traffic blend in with normal telemetry and reduces the chance that simple filtering rules will catch it.
Started as a single Ethereum contract which expanded into a cluster of 5 contracts, multiple operator wallets... The development started with the basic DomainStorage with no validation moved to the hardened DataStore variants.
I was able to retrieve the live C2 domain... deploying on ports 61611 & 61617, along with 2 additional live C2 domains.
Remus registers with its C2 over HTTP on non-standard ports then exfiltrates via multipart POST.
SockS5 proxy integration... was added to the malware... There were repeated references throughout the campaign to 'Restore' capabilities, multi-proxy compatibility, and token recovery workflows...
ErrTraffic v3, documented by LevelBlue in April 2026, uses the EtherHiding technique as DDR. The injected script on compromised WordPress sites queries a smart contract on a blockchain to retrieve the ErrTraffic C2 server.
“[Remus] uses POSTs to Ethereum smart contracts to receive a live C2… This technique is officially known as ‘etherhiding’… allowing it to act as a dead-drop resolver for the malware operator.”
“It communicates with a changing server address obtained through an Ethereum smart contract, a method called EtherHiding.”
A loader already on the victim's computer fetches ... blobs directly from a bare IP on TCP/5000 ... [or] retrieves a loader PE first.
“It communicates with a changing server address obtained through an Ethereum smart contract, a method called EtherHiding.”
The EtherHiding mechanism queries a smart contract on the Ethereum blockchain to retrieve the live C2 domain and port.
The plugin communicates with baxe[.]pics on port 48261 over unencrypted HTTP...
Packet captures ... revealed Remus communicates with its C2 server via an encrypted channel.
“All C2s are stored inside the binary in an encrypted chacha20 buffer” and “All data is encrypted using chacha20.”
“Remus has a unique network communication protocol in which it communicates and exfiltrates in a piecemeal fashion… each ‘step’ of the exfiltration process is sent separately… by a ‘&step=’ POST argument on the C2.”
“[Remus] sends stolen material in separate, smaller stages rather than one large transfer.”
...later expanded into... automated Telegram delivery methods... A number of early campaigns in February... specialized in... delivering logs through Telegram...
288 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.