Remus Infostealer Targets OpenAI and Anthropic API Tokens, Using EDR Evasion and Ethereum-Based C2

SpyCloud Labs details Remus, a Windows infostealer first seen in March 2026 that steals AI platform API tokens, browser credentials, 2FA secrets, and crypto wallets while evading EDR via syscall-hook removal.

SpyCloud Labs reverse engineered Remus, a Windows infostealer that surfaced on underground marketplaces around March 2026 and now targets credential folders for OpenAI, Anthropic, and other AI providers including Claude Code, Cursor, and Codex. It collects data from 21 browsers and 16 cold-wallet applications, as well as Discord, Telegram, Azure, Bitwarden, and 1Password, and can steal files referenced by Windows shortcuts. Remus removes syscall hooks to blind EDR tools and keeps encrypted syscall numbers in an in-memory reference table to frustrate static analysis. It is built with a private OLLVM obfuscation fork shared with LummaC2, suggesting shared tooling. Command-and-control servers are resolved via an Ethereum smart contract (EtherHiding) at 0x999941b74F6bbc921D5174A5b29911562cd2D7CF, and stolen data is encrypted with ChaCha20 and exfiltrated in small staged chunks. Infection typically begins with ClickFix fake CAPTCHA lures that trick victims into running commands themselves, in chains linked to SmokeLoader. Remus also checks Outlook for a file named honey@pot.com.pst to detect sandbox analysis environments. Stolen AI API tokens can enable consumption of paid model capacity and serve as a pivot into developer environments.

• Remus is a Windows infostealer first seen on underground marketplaces around March 2026, detailed by SpyCloud Labs
• Targets credential folders for OpenAI, Anthropic, Claude Code, Cursor, and Codex, plus Discord, Telegram, Azure, Bitwarden, and 1Password
• Collects data from 21 browsers and 16 cold-wallet applications
• Steals 2FA/authenticator browser extension secrets, potentially bypassing multi-factor authentication
• Removes syscall hooks and encrypts syscall numbers in an in-memory reference table to evade EDR and static analysis
• Uses a private OLLVM obfuscation fork shared with LummaC2, suggesting shared tooling
• Resolves C2 via Ethereum smart contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF using etherhiding
• Encrypts exfiltrated data with ChaCha20 and sends it in small staged chunks