New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets
SpyCloud Labs details Remus, a Windows infostealer harvesting AI platform API tokens, passwords, 2FA artifacts, and crypto wallets.
68
Malware
LummaC2
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 31, 2026
- Last mentionedSep 21, 2026
Timeline
2 articles · newest firstInfostealers Are Hijacking Claude Sessions and Draining Subscriptions
Infostealers hijacked active Claude sessions to bypass 2FA, drain paid usage and run unauthorized charges; Anthropic is revoking sessions and refunding.
68
Appears with
- Azureproduct · 1
- Gen Digitalvendor · 1
- Claude Codeproduct · 1
- Discordproduct · 1
- Cursorproduct · 1
- Bitwardenproduct · 1
- SpyCloud Labsorganization · 1
- SpyCloudvendor · 1
- Atomic Stealermalware · 1
- Anthropicorganization · 1
- Claudeai model · 1
- RedLinemalware · 1
- Google Cloudproduct · 1
- Remusmalware · 1
- OpenCodeproduct · 1
- StealCmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.