TL;DR
SpyCloud researchers spent several weeks reverse engineering Remus, a Windows infostealer malware that surfaced on underground marketplaces in March 2026. Remus targets browser cookies, cryptocurrency wallets, AI assistant credentials, and files across the victim’s disk. The findings:
- Collects from 21 browsers and 16 cold wallets, including an unusually large set of Mozilla extensions, several of them 2FA tools
- Recent builds steal AI credential folders used by Anthropic, OpenAI, and other providers, exposing API tokens and LLM usage history
- Uses syscall execution and COM objects to operate quietly, and strips syscall hooks to blind EDR tools before running
- Resolves its C2 through Ethereum smart contracts (etherhiding), a technique first used by DPRK operators in 2025
- Shares obfuscation routines and Chromium theft methods with LummaC2, pointing to overlapping tooling among threat actors
Remus is one of several infostealer threats SpyCloud Labs is tracking as criminals adapt their tooling. See the full research archive at SpyCloud Labs.
About Remus
Remus, which first appeared publicly around March 2026 (based on marketplace ad history), offers the following features, as observed in Image 1:
Remus has a few features that set it apart from other infostealers and make it a threat to contend with. First and foremost, it steals a large number of Mozilla extensions, including several 2FA extensions, which could lead to compromise of accounts should criminals obtain the secrets inside. Additionally, as of recent builds, Remus has begun targeting AI credential folders used by models owned by Anthropic, OpenAI, and others, allowing for the theft of API tokens and LLM usage history. Finally, the extensive use of obfuscation and bypass techniques makes Remus very stealthy on-system and effective in evading detection.
Based on publicly available reporting, a common lure for Remus is the ClickFix social engineering campaigns. ClickFix campaigns lure victims into running commands through fake captcha popups delivered via emails, malvertising, and compromised websites. Through these campaigns, victims are often prompted to install Remus themselves.
Evasion and Anti-Analysis
Hiding in Plain Sight: OLLVM Obfuscation
Upon first opening Remus, one of the initial observations that can be made is that Remus has similar obfuscation routines to families like LummaC2, as seen in Image 2.
Remus, LummaC2, and several other malware samples all make use of the same private OLLVM fork, which adds these string and arithmetic obfuscation routines into the compilation step to evade static detection and make reverse engineering challenging. This overlap of usage is confirmed with pivot yara rules off of the obfuscation algorithms used in the binary.
OLLVM, which stands for Obfuscator-LLVM, is an open source fork of the LLVM compilation suite, “able to provide increased software security through code obfuscation and tamper-proofing.” OLLVM and its various public and private forks are common tools used by cybercriminals to further protect their code, and while a direct connection to LummaC2 cannot be confirmed solely from the OLLVM usage, but the overlap is notable enough to mention.
Going Under the Hooks: Syscall Riding
In addition to the use of an OLLVM obfuscator, Remus leverages syscall riding for several of its more sensitive or “loud” functions. Syscalls, or system calls, are functions provided by the Operating System (OS) to allow programs direct access to system services, including hardware, peripherals, the kernel, and more. Remus leverages these syscalls in order to quietly read and write files to and from the system, interact with the OS, and more, without getting detected through typical EDR alerts.
In fact, prior to performing any actions, Remus first performs a syscall hook sweep and removes all system call hooks that may exist on the system. In order to obfuscate the syscall service numbers, Remus stores them all in an ID reference table that is decrypted in memory during malware setup. Service numbers are never referenced in code directly, and are instead referenced by the hashes set by Remus.
Borrowed Plumbing: COM Object Abuse
On Windows systems, compiled code will often need to interact with other compiled code without knowing the language it was compiled in or the environment, etc. In these instances, COM objects are used to allow code to interface with memory objects without needing to know the full structure of the code. Remus leverages these COM objects in several places: to enumerate victim information, and to enumerate and steal files from the victim system that are referenced in shortcut files. These exact routines are detailed further below. EDR tooling often looks for more specific Windows API or PowerShell mechanisms to flag, and because the COM objects Remus uses are relatively generic, this behavior can be somewhat stealthy.
Honey in the Trap: Outlook Sandbox Detection
Remus’ Outlook anti-analysis is fairly simple, searching the system for .pst files and then comparing those found files to a set string in order to detect sandbox environments. Remus steps through the victim’s Outlook storage directory and looks for *.pst files that match honey@pot.com.pst, which indicate that it is running in a sandbox environment, as observed in Image 3 below.
Command and control
Encrypted C2 Configuration
All C2s are stored inside the binary in an encrypted chacha20 buffer, which is decrypted during execution, as observed in Image 4.
Stealing Piece by Piece: Piecemeal Exfiltration
Remus has a unique network communication protocol in which it communicates and exfiltrates in a piecemeal fashion. All data is encrypted using chacha20, which adds an extra layer of security during communication. During data exfiltration, each “step” of the exfiltration process is sent separately, literally separated by a “&step=” POST argument on the C2. This behavior is necessary for three reasons, it allows:
- With Remus’ piecemeal exfiltration routine, if an attack gets detected during chrome password theft (for example), but it’s already stolen applications and Mozilla creds, the actor running the attack will at least still have the applications and Mozilla creds, whereas with other families they might get nothing.
- Remus customers to monitor exfiltrations with precision, seeing exactly what is successful and where attacks fail.
-
Remus customers to still exfiltrate data even when attacks are partially detected, greatly increasing the amount of potential data stolen.
- With Remus’ piecemeal exfiltration routine, if an attack gets detected during chrome password theft (for example), but it’s already stolen applications and Mozilla creds, the actor running the attack will at least still have the applications and Mozilla creds, whereas with other families they might get nothing.
- Remus to sneak by less sophisticated monitoring environments by sending smaller packets over time instead of a large amount of data at once.
Reading the Ledger: The Etherhiding
Frequently, when malware families cannot reach out to their embedded C2s, they will instead reach out to secondary infrastructure such as Steam or Pastebin in order to receive a live C2 that they can then contact. Remus is no exception; its dead drop algorithm is unique in that it uses POSTs to Ethereum smart contracts to receive a live C2. Currently, Remus sends a POST request to the following contract:
-
0x999941b74F6bbc921D5174A5b29911562cd2D7CF
At this RPC node:
-
https[:]//ethereum-rpc[.]publicnode[.]com
And receives back live URLs. SpyCloud analysts observed the following:
-
http[:]//fightwa[.]biz:5902
Following the Contract: Actor Pivots
Using publicly available tools like etherscan.io, additional detail about the actors can be pulled from this information. As observed in Image 5 below, the contract is called “DomainStorage” and has a single function of note: the write function. As would be expected, only the owner can modify this contract.
The owner of this contract is:
-
0xBeCFC3F9EB36E6Ec0E54f7A6627DA7EF648f8F01
The DomainStorage contract was created on Feb 25, 2026 at 15:35:11. Interestingly, a second contract (0xF6896c4ddD2B821d5d2B3c18459Acd9b5Ec1cE21) was created by the same owner for seemingly the same purpose on Feb 25, 2026 at 18:13:59. This contract is unused and appears to be a test.
This technique is officially known as “etherhiding”, and leverages the “eth_call” method in Ethereum contract interactions in order to request the malware domain from the Ethereum contract. This connection information is hardcoded into the malware, and can be changed on the contract end at any time, allowing it to act as a dead-drop resolver for the malware operator. This technique was first popularized by DPRK operators in early 2025.
Data theft and collection
Path Collection and Shortcut Resolution
One of the key theft routines in Remus is its path collection routine. This is used for wallet theft and many applications, as well as AI agents that may exist on victim systems. Any path can be specified, along with folder depth and even a wildcard regular expression mask to search for.
During file collection, Remus will leverage COM objects to stealthily enumerate and resolve shortcuts stored on the system, which helps find and steal files. The COM object usage can be observed in Image 7 below:
For each .lnk file found, the file is loaded using the COM object functionality for loading shortcut files, the referenced file is resolved, and then the path is passed to the file stealer function for file theft.
Targeted Applications and Wallets
The following applications are stolen by Remus by default:
1Password, 3D-FTP, AnyClient, AnyDesk, Authy Desktop, Auto FTP Manager, Azure, Bitwarden, Codex, Cursor, Em Client, FileZilla, FTP Commander Deluxe, FTP Manager Lite, FTPbox, FTPGetter, FTPInfo, FTPRush, Google Cloud, KeePass, NordPass, NordVPN, Notezilla, OpenCode, OpenVPN, ProtonVPN, Riot Games, SmartFTP, Sticky Notes, Telegram, Telegram UWP, TotalCommander, UltraVNC
The following wallets are stolen by Remus by default:
Armory, Atomic, Binance, Bitcoin Core, Coinomi, Daedalus, DashCore, ElectronCash, Electrum, Electrum-LTC, Ethereum, Exodus, Gleec, Guarda, JAXX New Version, Ledger Live, Neon, Ripple, Sparrow, Wasabi
Chromium-Based Browsers and Applications
Remus has the ability to steal from Chrome and Chromium browsers, as is standard in several stealers. However, as publicly reported by Gen Digital, Remus’ actual theft algorithm for Chromium is nearly identical to Lumma’s, showing yet another tie to LummaC2. As publicly reported, Remus uses a wildcard memory pattern to find an effective address for the os_crypt Encryptor function, which it then uses to extract the protected v20_master_key for Chromium credential theft.
Currently in default configurations, Remus targets the following browsers and applications:
360 Security Browser, Arc Browser, AVG Secure Browser, Brave-Browser, CentBrowser, Chedot, Chrome, Chrome Beta, Claude Code, CocCoc Browser, Comet Browser, CryptoTab Browser, Discord, Discord Canary, DiscordPTB, Edge, Epic Privacy Browser, Iridium, Maxthon, Opera, Opera Air, Opera GX, Opera Neon, QQBrowser, UCBrowser, Vivaldi, Wave Browser
Authenticator and 2FA extensions:
2FA Authenticator, 2FAS Auth, Authenticator, Authenticator 2FA Client, Authenticator App, Authy, EOS Authenticator, GAuth Authenticator, Google Authenticator, MFA (Multi Factor Authentication Assistant), TOTP Authenticator, Two-Factor Authentication, TypingDNA 2FA Authenticator, Web2FA
Notes extensions:
Chrome Notes, Edge Notes, Evernote, Leaf Notes, My Notes, Note Board, Note Sidebar, Notebook Web Clipper, Notes for Edge, Sticky Notes 3
Password manager extensions:
1Password, 1Password Nightly, AuthX Lite, Avira Password Manager, Bitwarden, BrowserPass, ByePass, C2 Password, Cloaked, CommonKey, Cyclonis, Dashlane, DualSafe, Enpass, ESET Password Manager, F-Secure Password Manager, GateKeeper, heylogin, IronVest, JumpCloud, Kee, Keeper, LastPass, MindYourPass, MultiPassword, MYKI Password Manager & Authenticator, Netwrix Password Secure, Norton Password Manager, Passbolt, Passky, Password Boss, Password Depot, pCloud Pass, Proton Password Manager, RoboForm, SAASPASS Password Manager & Authenticator, SafeInCloud, SecureSafe, Steganos, Sticky Password Manager, Total Password, Trezor Password Manager, Zoho Vault
Payment extensions:
Affirm, Crypto-Cardholder, Klarna, Moon, Pay with BitPay, Revolut Shopper, Zip Pay
Wallet extensions:
ABC Wallet, Alby, Ambire Wallet, ASI Alliance Wallet, Athene Wallet, Atomic Wallet, Auro Wallet, Aurox Wallet, Avian Browser Wallet, Backpack, Beam Web Wallet, Binance Wallet, Bitget Wallet, Bittensor Wallet, Braavos Wallet, Brave Wallet, Bybit Wallet, Casper Wallet, CLV Wallet, Clown Wallet, Coin98 Wallet, Coinbase Wallet, Compass Wallet, Concordium Wallet, Console Wallet, Core Wallet, Cosmostation Wallet, Cripz Wallet, Crossmark Wallet, Crypto.com, Ctrl Wallet, Cyano, DIAM Wallet, DID Wallet, Doge Labs Wallet, Ecto Wallet, Enkrypt, Eternl, Ethos Wallet, EVER Wallet, Exodus, FastSet Wallet, Fearless Wallet, Fewcha Move Wallet, Finnie, Flow Wallet, Fluvi Wallet, FoxWallet, Fuel Wallet, Fuelet Wallet, G.U. Wallet, Galaxy Station Wallet, Gate Wallet, Ghost Wallet, Glass Wallet, Glow, Goby, Guarda, Hana Wallet, HashPass Wallet, Hashpack, HAVAH Wallet, Hive Keychain, HYCON Lite Wallet, Internet Money, IOTA Wallet, Kabila Wallet, Kaia Wallet, KardiaChain Wallet, KasWare Wallet, Keeper Wallet, Keplr, Klever Wallet, Koala Wallet, Komodo Wallet, Lace, Leap Terra Wallet, Leap Wallet, Leather, Leo Wallet, LootRush Wallet, LuckyCoin Wallet, Magic Eden Wallet, Martian, Math Wallet, MathWallet, Mavryk Wallet, MetaMask, Meteor Wallet, Miden Wallet, Mojito, Monsta Wallet, MultiversX Wallet, MyTonWallet, Nabox Wallet, Nami, Nautilus Wallet, NeoLine, Nest Wallet, Nightly, Noone Wallet, Odin Wallet, OKX Wallet, OneKey, OORT Wallet, OpenMask, Opera Wallet, Orange Wallet, OsmWallet, Oyl Wallet, Pali Wallet, Pelagus, Petra Wallet, Phantom, PolkaGate, Polymesh Wallet, Pontem Wallet, Portkey Wallet, Prax Wallet, Pulse Wallet, PWR Wallet, Quantum Wallet, Rabby Wallet, Rainbow, Razor Wallet, Ready Wallet, Reef Chain Wallet, Ronin Wallet, ROSE Wallet, SafePal Extension Wallet, Salmon Wallet, Sender Wallet, Slush, Solflare Wallet, Stamp Wallet, StarKey Wallet, Stargazer Wallet, Station Wallet, SteemKeychain, SubWallet, Suiet, Suku Wallet, Surf Wallet, Talisman Wallet, Temple Wallet, TezBox, TokenPocket, Tomo Wallet, TON Hold, TON Wallet, Tonkeeper, TronLink, Trust Wallet, Typhon Wallet, Ultra Wallet, UniSat Wallet, Uniswap Extension, Venom Wallet, VESPR Wallet, Wigwam Wallet, Wizz Wallet, Wombat, xBull Wallet, Xverse, Yoroi, Zerion Wallet, ZilPay
Mozilla-Based Browsers
Remus has the ability to steal from Mozilla and Mozilla-like browsers, as is standard in several stealers. However, what sets Remus apart is the particularly extensive list of Mozilla extensions that it steals from. The full list of browsers and extensions that Remus targets is below:
Browsers:
Floorp Browser, Mozilla Firefox, Thunderbird, Waterfox, Zen Browser
Authenticator and 2FA extensions:
2FAS Auth, Authenticator, Authenticator App, TOTP
Password manager extensions:
1Password, Avast Password Manager, Avira Password Manager, Bitwarden, C2 Password, Dashlane, Delinea, Enpass, F-Secure Password Manager, IronVest, Kee, KeePassXC, Keeper, LastPass, NordPass, Norton Password Manager, pCloud Pass, Proton Pass, RoboForm, SafeInCloud, Sticky Password, Zoho Vault
Wallet extensions:
Alby, Ambire Wallet, Auro Wallet, Braavos, Casper Wallet, Cosmostation Wallet, Enkrypt, EVER Wallet, Fetch Wallet, Glow, Hive Keychain, HOT Wallet, Keeper Wallet, Keplr, MetaMask, MetaMask Legacy Web3, Mojito, Monsta Wallet, MultiversX Wallet, MyTonWallet, Nintondo Wallet, Paragon, Phantom, Pocket Universe, PolkaGate, Pontem Aptos Wallet, Rise Wallet, Ronin Wallet, SendWallet, Signum XT Wallet, Solflare Wallet, SSP Wallet, Station Wallet, SubWallet, Superhero, Talisman Wallet, Tonkeeper, xBull Wallet, XPLA Vault Wallet, Yoroi, Zerion Wallet, ZilPay
Registry
In addition to browser thefts, Remus also has the ability to steal data from registry entries in order to gather additional information about victim software installations. These entries can be highly customized to target specific keys. By default, the registry entries stolen are as follows:
Outlook, Outlook 13.0, Outlook 14.0, Outlook 15.0, RealVNC, TightVNC, TigerVNC
Interestingly, Outlook 13.0 was skipped by Microsoft, yet Remus includes this explicitly in its default configuration.
System Profiling
Remus also has a miscellaneous system profiler that is used to gather victim information and send it back to the C2. As observed in Image 8 below, some of this information, such as antivirus product information, is gathered using COM objects, allowing for stealthier information gathering than something louder such as PowerShell or registry interactions.
Notably, Remus partially assembles the system information log on the victim machine itself, complete with the string REMUS LOG, which is also exfiltrated to the C2.
Infrastructure
| Type | Value |
|---|---|
| Dead drop Contract (active) | 0x999941b74F6bbc921D5174A5b29911562cd2D7CF |
| Dead drop contract (unused) | 0xF6896c4ddD2B821d5d2B3c18459Acd9b5Ec1cE21 |
| Contract owner | 0xBeCFC3F9EB36E6Ec0E54f7A6627DA7EF648f8F01 |
| RPC Node | https[:]//ethereum-rpc[.]publicnode[.]com |
| C2 | fightwa[.]biz:5902 |
rule OLLVM_MBA_Multiply_XOR_Decoder {
meta:
author = "Spycloud"
description = "Linear MBA expansion of (K * counter) driving an XOR key stream; OLLVM-derivative MBA pass (Pluto/goron/arkari) or Tigress EncodeArithmetic"
reference = "decoder semantics: buf[i] ^= (uint8_t)(K * i)"
date = "2026-08-10"
notes = "ModRM reg field is pinned per-op: group 81/83 is an opcode group, NOT a single instruction. Wildcarding the whole ModRM admits cmp/adc/sub/add and false-positives on max(x,1) volume math."
strings: // K and ~K sum to 0xFF, so exactly one of the two masks is >= 0x80 and must // use the imm32 form (81 /r id); the other takes sign-extended imm8 (83 /r ib). // Order varies with the key, so both encodings are allowed at each site. // rm field stays wildcarded (register allocation + REX.B); reg field is fixed.
$mba = { ( 81 | 83 ) ( E0 | E1 | E2 | E3 | E4 | E5 | E6 | E7 ) [1-6] // and rX, mask -> b = x & ~K
[0-8] ( 81 | 83 ) ( E0 | E1 | E2 | E3 | E4 | E5 | E6 | E7 ) [1-6] // and rX, mask -> a = x & K
[0-6] ( 81 | 83 ) ( F0 | F1 | F2 | F3 | F4 | F5 | F6 | F7 ) [1-6] // xor rX, K -> a ^ K
[0-6] 0F AF ?? // imul -> term1
[0-8] ( 81 | 83 ) ( E0 | E1 | E2 | E3 | E4 | E5 | E6 | E7 ) [1-6] // and rX, K -> a
[0-6] ( 81 | 83 ) ( C8 | C9 | CA | CB | CC | CD | CE | CF ) [1-6] // or rX, K
[0-6] 0F AF ?? // imul -> term2
[0-8] 01 ?? // add -> term1 + term2
[0-8] 30 // xor r/m8, r8 -> key byte applied
}
condition:
#mba >= 2
} Discover what cybercriminals know about your business and your customers – and how to prevent targeted attacks with SpyCloud.
FAQs
Remus is a Windows infostealer that appeared on underground marketplaces in March 2026. It steals browser cookies, cryptocurrency wallets, AI assistant credentials, and files from across the victim’s disk.
Yes. Recent builds collect AI credential folders used by Anthropic, OpenAI, and other providers, exposing API tokens and LLM usage history.
Remus removes syscall hooks before running, executes sensitive functions through syscalls instead of standard API calls, and uses COM objects to gather system information and resolve shortcut files. Its code is also obfuscated using a private OLLVM fork shared with LummaC2.
Etherhiding is a technique where malware queries an Ethereum smart contract to retrieve a live C2 domain instead of hardcoding it in the binary. Remus uses this method to receive updated C2 infrastructure, a technique first used by DPRK operators in 2025.
Keep reading
