Loading story…
Researchers identified REMUS, a malware-as-a-service infostealer previously mistaken for SMOKELOADER, in campaigns delivering affiliate-specific payloads through ClickFix lures and PLYCHIP staging, DonutLoader in-memory shellcode, and cracked-software bundles using GoFlateLoader. REMUS is assessed to descend from Lumma Stealer via Tenzor, with separate affiliate infrastructure and uniquely identifiable builds.
The malware steals browser credentials, cookies, master keys, session tokens, clipboard contents, screenshots, selected files, and data from password-manager, cryptocurrency-wallet, and AI-client extensions. Stolen session material can enable account takeover even where MFA is enabled. Operators use victim screening, anti-analysis controls, memory-resident execution, rotating C2 servers, Host-header spoofing, and cleanup; premium users can use EtherHiding to retrieve C2 information from Ethereum smart contracts. Although REMUS configurations are ChaCha20-encrypted, captured payloads can be decrypted because required material is embedded in the binary.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The Remus developer announced that the stealer had expanded its collection capabilities to AI clients, including Claude, Codex, OpenCode, Cursor, and Devin.
CIS CTI identified Remus infostealer distribution activity from March through September 2026. The activity used ClickFix/PLYCHIP staging, DonutLoader in-memory shellcode, and cracked-software bundles containing GoFlateLoader.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gen Threat Labs identified **Remus** as a 64-bit information stealer and evolutionary continuation of Lumma Stealer, first observed in campaigns around January–February 2026. The malware retains Lumma-like string obfuscation, anti-VM checks, direct syscalls, indirect control-flow obfuscation, and browser-data theft, while using a browser-process shellcode injection technique to recover Chrome’s `v20_master_key` and bypass Application-Bound Encryption. It also steals credentials, cookies, cryptocurrency-related data, clipboard contents, and Outlook PST data, while adding sandbox-DLL checks and a honey PST-file anti-analysis mechanism. Remus replaced Lumma’s Steam and Telegram dead-drop C2 resolution with **EtherHiding**, using Ethereum smart contracts to resolve command-and-control infrastructure at runtime. Its operator said the malware has been sold as a malware-as-a-service offering since February 2026, with roughly 200 active customers, and acknowledged reworking code from transitional Tensor/Tenzor builds linked by researchers to Lumma. The operator also described continued updates to evade Microsoft Defender and Chrome security controls, and claimed plans for a fake Ledger Live application to capture cryptocurrency seed phrases, operator-panel AI features, and additional security bypasses.
Sep 21, 2026
Researchers linked the **Remus** infostealer to an evolving command-and-control architecture that stores live resolver data in **Ethereum smart contracts**, extending the malware’s use of EtherHiding beyond earlier Telegram and Steam dead-drop methods. Analysis of contract `0x999941b74F6bbc921D5174A5b29911562cd2D7CF` and its `0xc2fb26a6` function exposed a live C2 domain, `fightwa[.]biz:5902`, which had not appeared in prior public indicators; historical activity showed the infrastructure rotating from a test domain to `chalx[.]live:5902` and then to `fightwa[.]biz:5902`. The domain resolved to `185.53.179.128`, an IP already associated with Remus infrastructure, and researchers said monitoring blockchain `DomainUpdated` events could provide durable visibility into future C2 changes. Separate infrastructure mapping found the campaign spread across more than 15 ASNs but concentrated at **Hostinger International Limited** (`AS47583`) and **Team Internet AG** (`AS206834`), with `185.53.179.128` standing out as a likely convergence or exfiltration node. Investigators identified **five** Ethereum contracts used to hold live C2 data, showing a progression from simple `DomainStorage` designs to more controlled and stealthier `DataStore` variants, while malware analysis described Remus as a likely **Lumma-derived** 64-bit stealer that steals browser credentials, cookies, and cryptocurrency wallets. The malware also inherits Lumma’s browser-memory technique for bypassing Chromium **Application-Bound Encryption**, while adding compact shellcode, randomized hidden-browser desktop names, anti-analysis checks, and blockchain-backed C2 resilience.
Jul 2, 2026
Researchers traced multiple **SmokeLoader** operations to live command-and-control infrastructure that supported credential theft, screenshot capture, clipboard theft, host profiling, and data exfiltration. One March 2026 campaign used a **ClickFix** social-engineering lure, an MSI installer, and a Go-based loader to deploy the **Remus** plugin, with exfiltration sent to `baxe[.]pics:48261`; investigators extracted configuration data including the C2 URL, campaign ID, plugin markers, and a **ChaCha20** key that allowed captured traffic to be decrypted. Cross-sample analysis linked the same builder output to SmokeLoader deliveries via **Amadey**, **Phorpiex**, and the ClickFix/GOLoader chain, pointing to a shared malware-as-a-service or affiliate ecosystem. Separate analysis tied SmokeLoader to a broader dual-family operation involving **Fuery**, likely run by an operator using the alias **"ingermany"**, who used a Flask-based panel disguised as **"InsureFlow Pro"** and a second **"Monkey"** panel for Fuery management. Investigators documented repeated OPSEC failures across the infrastructure, including reused certificates, exposed registration data, same-day domain registrations, and a C2 domain that shared a VPS with a legitimate Arabic-language learning platform, `qimmaedu[.]com`, while malware traffic beaconed to `coox[.]live` and `baxe[.]pics`. The reports also highlighted unusual technical overlaps, including Go 1.20.1 builds, Raft protocol type-name obfuscation, split C2 services on high ports, and hosting links to providers and subnets previously associated with **Phorpiex**, reinforcing the assessment that financially motivated operators were reusing infrastructure across malware families and legitimate services.
Jun 29, 2026