Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials

Remus is a Windows information stealer that is gaining attention for the way it hides before taking data. The malware surfaced on underground marketplaces in March 2026 and is built to collect browser information, cryptocurrency wallet data, passwords, and files from compromised computers.

Its newer versions also seek credentials linked to AI tools, putting personal accounts and corporate development environments at risk.

The infection commonly begins with ClickFix social engineering. Victims encounter a fake CAPTCHA through email, malicious advertising, or a compromised website, then are persuaded to run a command themselves.

That human step can bypass protections designed to stop suspicious downloads, and it gives the stealer a quiet route onto Windows devices.

SpyCloud said in a report shared with Cyber Security News (CSN) that its researchers spent weeks reverse engineering Remus. The investigation found that the malware targets data from 21 browsers and 16 cold wallets, while also collecting a notably broad selection of Mozilla extensions, including extensions used for two factor authentication.

The risk extends beyond a single password reset. Stolen cookies can help attackers take over active browser sessions, while wallet data and saved logins can lead to direct financial loss.

API tokens and AI assistant histories may expose internal prompts, code, documents, and usage information that organizations did not expect to leave the device.

Remus Infostealer Removes Syscall Hooks

Remus tries to reduce scrutiny before it begins its collection work. It uses system calls, which are direct requests to Windows, for sensitive actions such as reading and writing files.

Before doing so, it scans for and removes hooks on these calls, interfering with a common way endpoint detection and response tools watch programs for suspicious behavior.

Instead of leaving system-call numbers plainly visible, the malware keeps them in a reference table that it decrypts in memory during setup. This makes static inspection more difficult.

The approach echoes tactics seen in recent EDR evasion campaigns, where attackers aim to weaken visibility before moving to credential theft or other harmful activity.

The stealer also uses generic Windows COM objects to profile a device, follow shortcuts, and obtain files. Those ordinary software components can make activity appear less unusual than commands launched through PowerShell.

Remus checks Outlook storage for a file named honey@pot.com.pst as a simple sandbox test, then can avoid running in an analysis environment.

Its network design adds another layer of resilience. Remus encrypts its command configuration and sends stolen material in separate, smaller stages rather than one large transfer.

If defenders interrupt one stage, an operator may still receive data gathered earlier. Smaller transfers may also be less conspicuous in environments with limited network monitoring.

Credentials, Wallets, and AI Data

Once active, Remus searches Chromium and Mozilla based browsers for cookies, stored passwords, extension data, and other profile material.

Its wide extension list includes password managers, wallet extensions, payment tools, note taking utilities, and authenticators.

Readers following fake CAPTCHA malware delivery should recognize the central lesson: a web verification check should never require someone to paste a command into Windows.

The malware can also gather data from remote access, VPN, cloud, messaging, and file-transfer applications, alongside files reached through Windows shortcuts.

It communicates with a changing server address obtained through an Ethereum smart contract, a method called EtherHiding. Similar blockchain based delivery methods let operators alter their infrastructure without updating every infected machine.

Organizations should treat a suspected Remus infection as an identity incident, not merely a malware cleanup. Isolate the endpoint, reset exposed passwords, revoke browser sessions and API tokens, rotate wallet-related secrets where appropriate, and review application access.

Security teams should hunt for the listed infrastructure, investigate unexpected clipboard-to-command activity, and keep endpoint, browser, and Windows protections fully updated.

They should also examine browser extension access, outbound connections from browser processes, and files created after a verification prompt.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Ethereum smart contract	0x999941b74F6bbc921D5174A5b29911562cd2D7CF	Active DomainStorage dead-drop contract used to retrieve live command-and-control infrastructure
Ethereum smart contract	0xF6896c4ddD2B821d5d2B3c18459Acd9b5Ec1cE21	Unused DomainStorage contract associated with the same owner
Ethereum address	0xBeCFC3F9EB36E6Ec0E54f7A6627DA7EF648f8F01	Owner address for the identified contracts
RPC node	hxxps://ethereum-rpc[.]publicnode[.]com	Ethereum RPC endpoint contacted to query the dead-drop contract
Command-and-control server	fightwa[.]biz:5902	Live C2 infrastructure returned through the contract resolver
File name	honey@pot[.]com.pst	Sandbox-detection filename searched in Outlook storage directories

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC