Emergence of Remus Stealer: A New Infostealer Threat

Stairwell

Emergence of Remus Stealer: A New Infostealer Threat

First seen 15 Jun 2026, 21:55 UTC • •66.5

Article Content

1 / 3

Browse articles

ThreatCluster •June 16, 2026 at 21:43 UTC

•Remus Stealer is a 64-bit infostealer that evolved from Lumma Stealer.
•It uses advanced techniques like EtherHiding to evade detection.
•Targets include financial services, healthcare, and government sectors.

Remus Stealer, a Malware-as-a-Service infostealer, emerged in 2026 as a successor to Lumma Stealer. It operates on a 64-bit architecture and employs advanced techniques like EtherHiding to store C2 addresses in Ethereum smart contracts. The malware targets financial services, healthcare, government, technology firms, and managed service providers (MSPs). It is capable of stealing credentials, browser cookies, authentication tokens, and cryptocurrency wallet data, with session theft being particularly dangerous as it can bypass multi-factor authentication (MFA). Infection vectors include phishing, fake software downloads, malvertising, and SEO poisoning. Remus has been growing in capabilities since its discovery in February 2026, indicating a significant threat landscape for organizations. Current defenses and detection methods are still being developed to counter this evolving threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 116d ago How this analysis works

Timeline

2026-02-01

Remus Stealer discovered

Remus Stealer was identified as a new infostealer, marking its entry into the malware landscape.

2026-06-12

Detection methods discussed

Stairwell published insights on detecting Remus Stealer, highlighting its capabilities and risks.

2026-06-15

Remus Stealer details published

Reddit article outlines Remus's features, infection vectors, and its evolution from Lumma Stealer.

More articles in this cluster (2)

Threat Graph

11 entities, 10 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (7)

Malware
Phishing
T1071 - Application Layer Protocol
T1113 - Screen Capture
T1115 - Clipboard Data
T1555.003 - Credentials From Web Browsers
T1566 - Phishing

Organization (1)

Ethereum

Malware (3)

Lumma Stealer
Remus Infostealer
Remus Stealer

Relationships

Lumma Stealer targets Ethereum
Remus Infostealer targets Ethereum
Remus Stealer targets Ethereum
Lumma Stealer related to Malware
Lumma Stealer related to Phishing
Lumma Stealer related to T1071 - Application Layer Protocol
Lumma Stealer related to T1113 - Screen Capture
Lumma Stealer related to T1115 - Clipboard Data
Lumma Stealer related to T1555.003 - Credentials From Web Browsers
Lumma Stealer related to T1566 - Phishing

Following this threat?

Track Lumma Stealer and Ethereum in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

SectopRAT Variant Exploits Legitimate Software for Remote Control Attacks A new variant of the SectopRAT remote access Trojan (RAT) has been discovered embedded in legitimate software from an Italian digital audio company. This multi-stage attack allows attackers to gain full remote control of Windows systems by concealing the malware within modified application components. The malware is…

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…