Loading story…
Gen Threat Labs identified Remus as a 64-bit information stealer and evolutionary continuation of Lumma Stealer, first observed in campaigns around January–February 2026. The malware retains Lumma-like string obfuscation, anti-VM checks, direct syscalls, indirect control-flow obfuscation, and browser-data theft, while using a browser-process shellcode injection technique to recover Chrome’s v20_master_key and bypass Application-Bound Encryption. It also steals credentials, cookies, cryptocurrency-related data, clipboard contents, and Outlook PST data, while adding sandbox-DLL checks and a honey PST-file anti-analysis mechanism.
Remus replaced Lumma’s Steam and Telegram dead-drop C2 resolution with EtherHiding, using Ethereum smart contracts to resolve command-and-control infrastructure at runtime. Its operator said the malware has been sold as a malware-as-a-service offering since February 2026, with roughly 200 active customers, and acknowledged reworking code from transitional Tensor/Tenzor builds linked by researchers to Lumma. The operator also described continued updates to evade Microsoft Defender and Chrome security controls, and claimed plans for a fake Ledger Live application to capture cryptocurrency seed phrases, operator-panel AI features, and additional security bypasses.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Remus was reportedly made available for public sale as a malware-as-a-service information stealer. Its operator later claimed the service had about 200 active customers.
Gen Threat Labs observed the first Remus infostealer campaigns around January to February 2026, with the report specifically dating campaigns back to February. The malware was described as a 64-bit evolutionary variant of Lumma rather than a replacement for it.
Observed Tenzor transitional samples carried an embedded build date of September 16, 2025. The samples contained traits and strings linking Lumma and the later Remus codebase.
Alleged core members of the Lumma Stealer operation were doxxed during a period spanning late August through October 2025. Gen Threat Labs said Tenzor development coincided with this period.
The Remus operator said the developers acquired Tensor source code and a VueJS panel, then substantially reworked the malware and replaced the panel code. The operator characterized Tensor as an apparent continuation or variant of Lumma Stealer.
Gen Threat Labs identified Remus and transitional Tenzor samples as Lumma Stealer variants, citing shared string obfuscation, anti-VM checks, syscall handling, control-flow obfuscation, and an Application-Bound Encryption bypass. The researchers also found that Remus replaced Lumma's Steam and Telegram dead-drop resolvers with Ethereum-based EtherHiding for runtime C2 resolution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 103 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcegendigital.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked the **Remus** infostealer to an evolving command-and-control architecture that stores live resolver data in **Ethereum smart contracts**, extending the malware’s use of EtherHiding beyond earlier Telegram and Steam dead-drop methods. Analysis of contract `0x999941b74F6bbc921D5174A5b29911562cd2D7CF` and its `0xc2fb26a6` function exposed a live C2 domain, `fightwa[.]biz:5902`, which had not appeared in prior public indicators; historical activity showed the infrastructure rotating from a test domain to `chalx[.]live:5902` and then to `fightwa[.]biz:5902`. The domain resolved to `185.53.179.128`, an IP already associated with Remus infrastructure, and researchers said monitoring blockchain `DomainUpdated` events could provide durable visibility into future C2 changes. Separate infrastructure mapping found the campaign spread across more than 15 ASNs but concentrated at **Hostinger International Limited** (`AS47583`) and **Team Internet AG** (`AS206834`), with `185.53.179.128` standing out as a likely convergence or exfiltration node. Investigators identified **five** Ethereum contracts used to hold live C2 data, showing a progression from simple `DomainStorage` designs to more controlled and stealthier `DataStore` variants, while malware analysis described Remus as a likely **Lumma-derived** 64-bit stealer that steals browser credentials, cookies, and cryptocurrency wallets. The malware also inherits Lumma’s browser-memory technique for bypassing Chromium **Application-Bound Encryption**, while adding compact shellcode, randomized hidden-browser desktop names, anti-analysis checks, and blockchain-backed C2 resilience.
Jul 2, 2026
Security researchers reported sustained infostealer activity centered on **Lumma Stealer** and **Vidar**, with operators distributing malware through fake CAPTCHA lures, pirated software downloads, phishing emails, and poisoned search results. AhnLab said July 2026 campaigns commonly delivered **Remus, LummaC2, ACRStealer, and Vidar** via cracked software hosted on services including **mega.nz**, **Amazon S3**, and **MediaFire**, while Microsoft and other well-known brands were frequently impersonated. TrendAI separately described fake verification pages that trick victims into pasting malicious commands into the Windows Run dialog, leading to multistage infections that deployed **Lumma Stealer, Rhadamanthys, AsyncRAT, XWorm,** and **Emmenhtal**. The campaigns relied on evasive execution chains using `mshta.exe`, obfuscated PowerShell, DLL sideloading, temporary Chromium profiles, and even MP3 files carrying injected JavaScript to load payloads in memory and communicate with attacker-controlled infrastructure. Researchers also said **Vidar Stealer 2.0** expanded its appeal with a rewritten codebase, multithreaded theft, stronger anti-analysis, and broader credential and wallet theft, helping it gain momentum as some criminals moved away from Lumma after a doxxing incident and Telegram account compromise disrupted Lumma operations and eroded trust in its malware-as-a-service ecosystem. The reporting indicates that infostealer operators are rapidly shifting delivery methods and malware families while continuing to target both enterprises and individual users for credential theft and follow-on attacks.
Aug 21, 2026
**Lumma Stealer** continued to expand as a prolific malware-as-a-service infostealer, with researchers reporting sharp growth in detections and increasingly diverse delivery chains. Microsoft attributed the malware and its command-and-control ecosystem to **Storm-2477**, which operates Lumma for affiliates that build payloads and run campaigns through a management panel. ESET reported Lumma detections surged **369%** in late 2024, while additional reporting from Netskope and other researchers highlighted ongoing **fake CAPTCHA/ClickFix** lures and fresh payload variants designed to evade detection. Observed campaigns used multiple infection paths, including phishing, malvertising, compromised websites, trojanized software, abuse of trusted platforms such as GitHub, and delivery by other malware including **DanaBot**. Microsoft described an early-April campaign that combined **EtherHiding** hosted through Binance Smart Chain smart contracts with ClickFix social engineering, and an April 7 campaign targeting Canadian organizations that used **Prometheus TDS** redirection plus `mshta` and PowerShell stages to deploy Lumma alongside **Xworm**. The malware was reported stealing credentials and cryptocurrency wallets, using process injection and hollowing, and relying on layered infrastructure with hardcoded domains and fallback channels through **Steam** and **Telegram** behind Cloudflare; Microsoft said its disruption effort led to the takedown, suspension, or blocking of about **2,300 malicious domains** tied to Lumma operations.
Aug 15, 2026