New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets
SpyCloud Labs details Remus, a Windows infostealer harvesting AI platform API tokens, passwords, 2FA artifacts, and crypto wallets.
SpyCloud Labs reverse engineered Remus, a Windows infostealer first seen on underground marketplaces around March 2026 that now targets credential folders for OpenAI, Anthropic, and other AI providers. It collects data from 21 browsers and 16 cold-wallet applications, including Claude Code, Cursor, Codex, Discord, Telegram, Azure, Bitwarden, and 1Password, and can steal files referenced by Windows shortcuts. Remus uses a private OLLVM fork shared with LummaC2, performs syscall-hook sweeps to evade EDR, and resolves C2 servers via an Ethereum smart contract using etherhiding, encrypting data with ChaCha20 for staged exfiltration. Infection typically occurs through ClickFix social engineering, and stolen AI API tokens can enable consumption of paid model capacity and pivoting into developer environments.
- Targets credential folders for OpenAI, Anthropic, Claude Code, Cursor, and Codex
- Collects 2FA extension secrets, potentially bypassing multi-factor authentication
- Etherhiding resolves C2 via Ethereum contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF
- Shares OLLVM obfuscation fork with LummaC2, suggesting shared tooling
- Delivered via ClickFix fake CAPTCHA chains linked to SmokeLoader
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1539 Steal Application Access TokenT1005 Data from Local SystemT1566 PhishingT1059.003 Windows Command Shell
- Vendors
- SpyCloudGen Digital
- Malware
- RemusSmokeLoaderLummaC2
- Organizations
- SpyCloud Labs
- AI models
- OpenAI APIAnthropic API
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ethereum-rpc.publicnode.com | contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF through ethereum-rpc[.]publicnode[.]com; the contract can function as a dead-drop resolver, ena |
From the original article
4 min read at gbhackers.com
A newly tracked Windows infostealer dubbed Remus is expanding its credential-theft playbook by targeting API tokens and local usage data tied to AI platforms, including OpenAI and Anthropic.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.