21-09-2026
Remus: A New Infostealer Hunting Wallets, Passwords, and AI Credentials
https://spycloud.com/blog/remus-a-new-infostealer/
Report completeness: High
Threats:
Remus
Etherhiding_technique
Lumma_stealer
Clickfix_technique
Dead_drop_technique
Anydesk_tool
Ultra_vnc_tool
Jump_cloud_tool
Realvnc_tool
Tigervnc_tool
Victims:
Cryptocurrency users, Artificial intelligence service users, Browser users
Geo:
Dprk
TTPs:
Tactics: 2
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1005, T1012, T1027, T1030, T1041, T1071.001, T1082, T1083, T1102.001, T1106, have more...
IOCs:
Coin: 3
Url: 2
Domain: 1
Soft:
Anthropic, OpenAI, Chromium, OLLVM, Outlook, chrome, Steam, Pastebin, etherscan, 1Password, have more...
Wallets:
bitcoincore, coinomi, daedalus, dashcore, electron_cash, electrum, exodus_wallet, jaxx, wassabi, trezor, have more...
Crypto:
ethereum, binance, ripple, casper, multiversx, uniswap
Algorithms:
zip, xor, chacha20
Win API:
Arc
Languages:
powershell
YARA: Found
Links:
https://github.com/obfuscator-llvm/obfuscator/wiki