Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials
New Remus Windows infostealer removes syscall hooks to evade EDR, stealing browser credentials, crypto wallets, and AI tool data via ClickFix lures and EtherHiding C2.
Remus, a Windows infostealer that surfaced on underground marketplaces in March 2026, targets data from 21 browsers, 16 cold wallets, browser extensions including authenticators, and AI tool credentials. SpyCloud researchers found it removes syscall hooks to blind EDR tools and keeps encrypted syscall numbers in an in-memory reference table. Infections begin with ClickFix fake CAPTCHA lures that convince victims to run commands themselves. Its C2 infrastructure is resolved via Ethereum smart contracts (EtherHiding), and it checks for an Outlook file named honey@pot.com.pst to detect sandboxes.
- Delivered via ClickFix fake CAPTCHA lures that trick users into running commands themselves.
- Removes syscall hooks and encrypts syscall numbers in memory to evade EDR and static analysis.
- Steals data from 21 browsers, 16 cold wallets, and extensions including 2FA authenticators.
- C2 resolved through Ethereum smart contracts (EtherHiding); stolen data exfiltrated in small encrypted stages.
- Checks Outlook for honey@pot.com.pst file to detect sandbox analysis environments.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ethereum-rpc.publicnode.com | Owner address for the identified contracts RPC node hxxps://ethereum-rpc[.]publicnode[.]com Ethereum RPC endpoint contacted to query the dead-drop |
| domain | fightwa.biz | to query the dead-drop contract Command-and-control server fightwa[.]biz:5902 Live C2 infrastructure returned through the contract |
| domain | pot.com | ture returned through the contract resolver File name honey@pot[.]com.pst Sandbox-detection filename searched in Outlook storag |
| url | https://ethereum-rpc.publicnode.com | 48f8F01 Owner address for the identified contracts RPC node hxxps://ethereum-rpc[.]publicnode[.]com Ethereum RPC endpoint contacted to query the dead-drop |
From the original article
4 min read at cybersecuritynews.com
Remus is a Windows information stealer that is gaining attention for the way it hides before taking data. The malware surfaced on underground marketplaces in March 2026 and is built to collect browser information, cryptocurrency wallet data, passwords, and files from compromised computers. Its newer versions also seek credentials linked to AI tools, putting personal […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.