Loading story…
A fake-cheat campaign targeting players of Meccha Chameleon used GitHub repositories with fabricated popularity indicators to distribute an NSIS installer containing an Electron/JavaScript dropper, a Go loader, and the Remus infostealer. The dropper requests elevation, profiles the host, captures a desktop screenshot, reports infections through Telegram, adds Microsoft Defender exclusions, and repeatedly launches its loader through six execution mechanisms.
The Go loader decrypts and manually maps the Remus payload, which performs anti-analysis checks and steals browser, Roblox, Steam, clipboard, and other victim data. Remus can also receive operator-directed tasks to collect files, registry entries, browser extensions, and screenshots, or to execute arbitrary commands and payloads. The campaign's Telegram collection channel reportedly received data from more than 280 compromised hosts within roughly one day of its June 30 launch.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
During approximately one day after the campaign began, the attacker-operated Telegram collection channel received infection data from more than 280 hosts.
A campaign using GitHub repositories advertising fake Meccha Chameleon cheats began distributing an NSIS installer that ultimately deployed the Remus infostealer.
The analyzed Remus infostealer build recorded a build date of June 28, 2026 in its Info.yml victim profile.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Remus** Windows infostealer is being distributed through SEO-poisoned fake cracked-software and warez sites, with repeated Turkish-language lures indicating a likely focus on Turkish-speaking users seeking pirated tools and games. After execution, the malware injects into active Chromium-based browser processes to access browser vault data and steal saved passwords, cookies, crypto wallet information, password manager contents, FTP credentials, clipboard data, screenshots, enterprise email storage files, gaming platform data, and system reconnaissance details. Researchers reported that Remus resolves its command-and-control infrastructure through an **Ethereum smart contract**, allowing operators to rotate backend servers without updating the malware binary. Stolen data is then exfiltrated over HTTP POST to newly registered domains, in some cases with a spoofed `Host` header designed to resemble legitimate technology vendor telemetry traffic. The campaign appears to rely on rotating domains and IPs and to share open-directory delivery infrastructure with other infostealer families, highlighting a broader fake-cracked-software distribution ecosystem rather than a single isolated malware operation.
Aug 6, 2026
Researchers identified **REMUS**, a malware-as-a-service infostealer previously mistaken for SMOKELOADER, in campaigns delivering affiliate-specific payloads through ClickFix lures and PLYCHIP staging, DonutLoader in-memory shellcode, and cracked-software bundles using GoFlateLoader. REMUS is assessed to descend from Lumma Stealer via Tenzor, with separate affiliate infrastructure and uniquely identifiable builds. The malware steals browser credentials, cookies, master keys, session tokens, clipboard contents, screenshots, selected files, and data from password-manager, cryptocurrency-wallet, and AI-client extensions. Stolen session material can enable account takeover even where MFA is enabled. Operators use victim screening, anti-analysis controls, memory-resident execution, rotating C2 servers, Host-header spoofing, and cleanup; premium users can use EtherHiding to retrieve C2 information from Ethereum smart contracts. Although REMUS configurations are ChaCha20-encrypted, captured payloads can be decrypted because required material is embedded in the binary.
Oct 2, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026