Emergence of Remus Stealer: A New Infostealer Threat

Remus Stealer, a Malware-as-a-Service infostealer, emerged in 2026 as a successor to Lumma Stealer. It operates on a 64-bit architecture and employs advanced techniques like EtherHiding to store C2 addresses in Ethereum smart contracts. The malware targets financial services, healthcare, government, technology firms, and managed service providers (MSPs). It is capable of stealing credentials, browser cookies, authentication tokens, and cryptocurrency wallet data, with session theft being particularly dangerous as it can bypass multi-factor authentication (MFA). Infection vectors include phishing, fake software downloads, malvertising, and SEO poisoning. Remus has been growing in capabilities since its discovery in February 2026, indicating a significant threat landscape for organizations. Current defenses and detection methods are still being developed to counter this evolving threat.

Key Points: • Remus Stealer is a 64-bit infostealer that evolved from Lumma Stealer. • It uses advanced techniques like EtherHiding to evade detection. • Targets include financial services, healthcare, and government sectors.