Remus Stealer
Remus Stealer is a rapidly evolving Malware-as-a-Service infostealer that emerged in 2026. Remus also shifted from Lumma's 32-bit architecture and traditional resolvers to 64-bit with EtherHiding and enhanced anti-analysis (e.g., sandbox DLL checks, PST honeypot detection). It utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns. The malware steals credentials, browser cookies, authentication tokens, and cryptocurrency wallet data. Session theft is one of Remus's most dangerous capabilities because it can bypass MFA by stealing active session cookies directly from browser memory. The malware shows strong technical similarities to Lumma Stealer and may represent its evolutionary successor. Financial services, healthcare, government, technology firms, and MSPs are particularly attractive targets. Common infection vectors include phishing, fake software downloads, malvertising, and fake CAPTCHA campaigns, as well as SEO poisoning and fake GitHub projects to trick tech-savvy users. See whole ANY.RUN execution chain at Check out whole malware analysis report at submitted by /u/rifteyy_ [link] [ ]
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
