What happened
Researchers at SpyCloud have published a deep-dive on Remus, a Windows infostealer that first appeared on underground marketplaces in March 2026 and has been steadily gaining capability since. Like other stealers, its job is to grab browser data, cryptocurrency wallets, and files from an infected machine — but its defense-evasion work sets it apart.
Before it starts collecting anything, Remus scans the system for hooks placed by endpoint detection and response (EDR) tools on Windows system calls — the low-level requests programs use to read and write files. It removes those hooks, and keeps the table of system-call numbers it relies on encrypted in memory rather than sitting in the binary in plain view, which makes the sample harder to analyze statically.
To blend in further, Remus performs some of its reconnaissance — profiling the device, following shortcuts, pulling files — through ordinary Windows COM objects instead of PowerShell, so the activity looks closer to normal software behavior. It also checks for a specific file in Outlook storage as a sandbox test, and holds back if it finds signs of an analysis environment.
Once it decides it's safe to proceed, Remus targets saved data across roughly 21 Chromium- and Mozilla-based browsers and 16 cold-wallet applications, along with a wide range of browser extensions — password managers, crypto wallets, payment tools, note-taking apps, and two-factor authentication extensions. Newer builds also go after credentials and session data tied to AI tools, which can expose internal prompts, code, and documents that never should have left the device.
For command-and-control, Remus uses a technique called dead-drop resolution: it reads its current server address from an Ethereum smart contract instead of hardcoding a domain. That lets operators rotate infrastructure without pushing updates to infected machines. Stolen data is exfiltrated in separate, encrypted chunks, so defenders who catch one transfer don't necessarily stop the rest.
Why it matters
A Remus infection isn't a simple malware-cleanup job. Stolen session cookies can let an attacker take over a logged-in browser session without ever needing a password. Wallet data and saved credentials can translate directly into financial loss. And because the malware specifically hunts for API tokens and AI assistant histories, an infected employee's laptop can leak internal source code, documents, and business context well beyond a single account.
What to do
- Treat a suspected Remus infection as an identity incident, not just a malware removal: isolate the endpoint, reset exposed passwords, revoke active browser sessions, and rotate API tokens.
- Watch for unusual COM-based activity and clipboard-to-terminal command execution — both feature in Remus's playbook for staying under the radar.
- Audit which browser extensions are installed across the fleet, and flag anything unexpected in password managers, wallet extensions, or 2FA tools.
- Keep endpoint, browser, and OS protections current, and monitor outbound connections from browser processes for irregular patterns.