A potent new strain of Windows malware called Remus is raising alarms among cybersecurity experts. Emerging publicly on underground forums in March 2026, the infostealer is engineered to siphon off browser profiles, saved credentials, cryptocurrency wallet contents, and even data tied to AI-powered tools—all while working to stay under the radar. Recent analyses reveal novel evasion techniques that make this threat particularly dangerous.
How Remus Works: Evading Endpoint Security
Remus begins its attack via “ClickFix” social engineering tricks: victims are lured through fake CAPTCHA prompts delivered via email, poisoned advertising, or compromised websites. These prompts ask users to manually execute commands, helping the malware slip past defenses that usually flag automated or downloaded tools. Once tricked, an endpoint is compromised.
From there, Remus employs system calls (direct Windows OS requests) to access sensitive operations—like reading files or grabbing browser data—but first it hunts for and removes hooks placed by endpoint detection and response (EDR) tools. By storing syscall identifiers in a decrypted-in-memory table rather than exposing them plainly, it evades static analysis that many security tools rely on.
Other stealth tactics include using legitimate Windows COM objects to perform profiling and file access, avoiding use of suspicious executables or PowerShell commands. It detects sandbox environments by searching for a specific file—“[email protected]”—in Outlook storage; if found or absent as expected, it may shut down operations to avoid detection. Network communication is similarly designed to fly under the radar, sending stolen data in small, encrypted batches rather than one massive dump.
What’s at Risk: Credentials, AI Tokens & Wallets
Once Remus settles in, it aggressively searches through both Chromium- and Mozilla-based browsers for cookies, saved passwords, extension data—including those tied to two-factor authentication—and other profile information. Browser extensions tied to wallets, payment tools, authenticators, and note-taking apps are also targeted.
The malware doesn’t stop at browsers. It also scours remote access applications, VPNs, messaging tools, cloud software, file-transfer programs, and local files accessed through Windows shortcuts. Newer versions of Remus specifically go after AI tools—extracting API tokens and even history logs from AI assistants. That means prompts, internal documents, or development environment data that were never intended for an external threat actor could be exposed.
Infrastructure used by Remus to deliver commands also features clever obfuscation. It leverages a technique known as EtherHiding: command-and-control (C2) infrastructure addresses are retrieved via smart contracts on the Ethereum blockchain. This allows operators to change active servers without needing to issue updates to already infected machines.
Indicators & Recommended Response
Key signs of a Remus infection include the use of specific Ethereum smart contracts (notably “0x999941b74F6bbc921D5174A5b29911562cd2D7CF” and “0xF6896c4ddD2B821d5d2B3c18459Acd9b5Ec1cE21”), the associated owner address (“0xBeCFC3F9EB36E6Ec0E54f7A6627DA7EF648f8F01”), and an RPC node domain (“ethereum-rpc.publicnode.com”). A live C2 server is also traced to “fightwa.biz:5902”. The “[email protected]” filename is used as a sandbox check in Outlook storage.
When handling a suspected breach, organizations should treat it as an identity compromise—not merely a malware cleanup. Essential steps include isolating affected devices, resetting all exposed credentials, revoking browser sessions and API tokens, rotating secrets tied to wallets, and reviewing application permissions. Detection efforts should focus on monitoring for unexpected clipboard or command execution, browser extension behaviors, and outbound connections initiated by browser processes.
Analytical perspective: Remus represents a notable evolution in infostealer threats—it doesn’t merely steal data, it actively dismantles the very visibility mechanisms designed to detect its activity. The use of syscall hooks removal, EtherHiding, and sandbox evasion push it into more dangerous territory. Moving forward, defenders must assume that malware is designed with awareness of their tools. Staying ahead means tailoring detection to behavior rather than signature alone, emphasizing runtime monitoring, endpoint visibility, and strong policies around manual command execution. The days of relying on static defenses are slipping behind.
