New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets

A newly tracked Windows infostealer dubbed Remus is expanding its credential-theft playbook by targeting API tokens and local usage data tied to AI platforms, including OpenAI and Anthropic.

Researchers at SpyCloud Labs found that recent Remus builds harvest browser data, password-manager and 2FA-extension artifacts, cryptocurrency-wallet files, application credentials, and AI assistant credential folders, potentially exposing both individual accounts and organizational AI workloads

SpyCloud researchers spent several weeks reverse engineering the malware, which appeared on underground marketplaces around March 2026.

The stealer is notable not just for the breadth of its collection routines, but for combining Lumma-style browser theft with system-call evasion, COM-object abuse, staged exfiltration, and Ethereum-based command-and-control resolution.

The latest Remus configurations target credential folders used by Anthropic, OpenAI, and other AI providers.

The theft of API tokens could allow criminals to consume paid model capacity, access AI-development workflows, or pivot into systems connected to compromised developer environments.

Locally stored LLM usage history may also expose prompts, project context, code fragments, cloud details, internal URLs, credentials accidentally entered into chats, and other sensitive operational data.

The risk is especially acute where developers use AI coding tools alongside source-control, cloud, and ticketing platforms.

Security reporting on the wider infostealer trend has documented the theft of access and refresh tokens, prompt histories, conversation databases, and MCP configuration files artifacts that can contain API keys for connected services.

This makes Remus more than a conventional password stealer. An exposed AI token can become a non-human identity incident: an attacker may not need to crack a password or defeat MFA if a reusable API credential has already been copied from a compromised endpoint.

Remus targets data from 21 browsers and 16 cold-wallet applications, according to SpyCloud.

Its default collection list includes Chromium-based browsers such as Chrome, Edge, Brave, Opera, Vivaldi, Arc, and Chrome Beta, as well as applications including Claude Code, Cursor, Codex, OpenCode, Discord, Telegram, Azure, Google Cloud, Bitwarden, 1Password, KeePass, NordVPN, and OpenVPN.

The malware also collects a particularly large set of Mozilla extension artifacts. Targets include authenticator extensions, password managers, notes applications, and crypto-wallet data.

The inclusion of 2FA-related extensions is significant because stored authenticator secrets or session material could enable account takeover even when victims have enabled multi-factor authentication.

Remus, LummaC2, and several other malware samples all make use of the same private OLLVM fork, which adds these string and arithmetic obfuscation routines.

Remus can also resolve Windows shortcut files and steal the files to which they point. This gives operators another route to collect valuable documents from user-accessible locations without relying exclusively on fixed directory paths.

A common infection path is ClickFix social engineering. In these campaigns, victims encounter fake CAPTCHA prompts distributed through phishing, malvertising, or compromised websites, then are tricked into pasting and running malicious commands themselves.

Remus Infostealer Campaign

Public reporting has linked Remus activity to ClickFix-to-SmokeLoader delivery chains.

SpyCloud Researchers reported, recapturing 18.1 million exposed API keys and tokens in 2025 across cloud, payment, developer, collaboration, and AI services, underscoring the growing scale of this problem.

Once active, Remus uses a private Obfuscator-LLVM fork for string and arithmetic obfuscation.

SpyCloud found overlap between its obfuscation routines and those used by LummaC2, while Gen Digital reported that Remus’s Chromium credential-theft approach closely resembles Lumma’s implementation.

The overlaps do not independently prove a single operator, but they point to shared code, tooling, or development knowledge across the ecosystem.

Remus also performs a syscall-hook sweep before theft activity, removing hooks that endpoint detection and response products may use to observe suspicious behavior.

It then uses syscall execution for sensitive actions and generic Windows COM objects to enumerate system information, shortcuts, and files more quietly than overt API-heavy techniques.

One of Remus’s most resilient features is its use of etherhiding to resolve live command-and-control infrastructure.

Rather than relying solely on a hardcoded C2 domain, the malware queries an Ethereum smart contract through a public RPC service and decodes the returned data into its current server address.

SpyCloud observed Remus querying contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF through ethereum-rpc[.]publicnode[.]com; the contract can function as a dead-drop resolver, enabling operators to update C2 destinations without rebuilding and redistributing the malware.

Remus encrypts C2 configuration and stolen data using ChaCha20, then exfiltrates information in stages using separate requests.

This piecemeal model means attackers may retain data already collected even if the endpoint detects the malware midway through execution.

Organizations should treat local AI credentials like high-value cloud secrets. API keys should be stored in managed secret stores rather than browser profiles, chat-tool directories, source repositories, or local plaintext configuration files.

Security teams should rotate OpenAI, Anthropic, cloud, source-control, and wallet credentials after a suspected Remus infection, revoke active browser sessions, and review AI-platform usage logs for anomalous consumption.

Detection teams should monitor for suspicious eth_call JSON-RPC traffic to public Ethereum nodes, particularly from workstations that do not have a business need to interact with blockchain infrastructure.

They should also investigate fake CAPTCHA workflows, unexpected command execution spawned by browsers, anomalous COM-based file enumeration, and outbound staged HTTP POST traffic.

Blocking known Remus-related C2 infrastructure and tracking Ethereum smart-contract resolver behavior can further improve coverage.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC