Loading story…
The Remus Windows infostealer is being distributed through SEO-poisoned fake cracked-software and warez sites, with repeated Turkish-language lures indicating a likely focus on Turkish-speaking users seeking pirated tools and games. After execution, the malware injects into active Chromium-based browser processes to access browser vault data and steal saved passwords, cookies, crypto wallet information, password manager contents, FTP credentials, clipboard data, screenshots, enterprise email storage files, gaming platform data, and system reconnaissance details.
Researchers reported that Remus resolves its command-and-control infrastructure through an Ethereum smart contract, allowing operators to rotate backend servers without updating the malware binary. Stolen data is then exfiltrated over HTTP POST to newly registered domains, in some cases with a spoofed Host header designed to resemble legitimate technology vendor telemetry traffic. The campaign appears to rely on rotating domains and IPs and to share open-directory delivery infrastructure with other infostealer families, highlighting a broader fake-cracked-software distribution ecosystem rather than a single isolated malware operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-30, Unit 42 published findings on an active Remus infostealer campaign spread through SEO-poisoned fake cracked-software sites using Turkish-language lures. The report detailed browser injection, credential theft, Ethereum smart-contract-based C2 resolution, and shared multi-family delivery infrastructure.
Unit 42 reported that several open-directory malware delivery domains hosting Remus and other infostealers had fresh samples uploaded as recently as 2026-07-27, indicating the distribution infrastructure was actively maintained.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceraw.githubusercontent.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked the **Remus** infostealer to an evolving command-and-control architecture that stores live resolver data in **Ethereum smart contracts**, extending the malware’s use of EtherHiding beyond earlier Telegram and Steam dead-drop methods. Analysis of contract `0x999941b74F6bbc921D5174A5b29911562cd2D7CF` and its `0xc2fb26a6` function exposed a live C2 domain, `fightwa[.]biz:5902`, which had not appeared in prior public indicators; historical activity showed the infrastructure rotating from a test domain to `chalx[.]live:5902` and then to `fightwa[.]biz:5902`. The domain resolved to `185.53.179.128`, an IP already associated with Remus infrastructure, and researchers said monitoring blockchain `DomainUpdated` events could provide durable visibility into future C2 changes. Separate infrastructure mapping found the campaign spread across more than 15 ASNs but concentrated at **Hostinger International Limited** (`AS47583`) and **Team Internet AG** (`AS206834`), with `185.53.179.128` standing out as a likely convergence or exfiltration node. Investigators identified **five** Ethereum contracts used to hold live C2 data, showing a progression from simple `DomainStorage` designs to more controlled and stealthier `DataStore` variants, while malware analysis described Remus as a likely **Lumma-derived** 64-bit stealer that steals browser credentials, cookies, and cryptocurrency wallets. The malware also inherits Lumma’s browser-memory technique for bypassing Chromium **Application-Bound Encryption**, while adding compact shellcode, randomized hidden-browser desktop names, anti-analysis checks, and blockchain-backed C2 resilience.
Jul 2, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026