Remus Infostealer Evades EDR by Removing Syscall Hooks, Steals Credentials

Key Takeaways

• Remus is a sophisticated Windows infostealer first observed in March 2026, actively sold on underground forums.
• It employs advanced evasion techniques, including removing syscall hooks, to bypass Endpoint Detection and Response (EDR) solutions.
• The malware targets a wide array of sensitive data, including browser credentials, cryptocurrency wallet information, and increasingly, credentials for AI tools.
• Initial infection often leverages social engineering through fake CAPTCHAs, tricking users into executing malicious commands.
• Organizations should treat Remus infections as identity compromise incidents, requiring comprehensive password resets, session revocations, and thorough forensic analysis.

Remus Infostealer Emerges with Advanced Evasion Tactics

A new Windows-based information stealer, dubbed Remus, has garnered significant attention from cybersecurity researchers due to its sophisticated stealth capabilities. First appearing on dark web marketplaces in March 2026, Remus is designed to exfiltrate a broad spectrum of sensitive data, encompassing browser information, cryptocurrency wallet contents, saved passwords, and various files from compromised systems.

Recent iterations of Remus have expanded their targeting to include credentials associated with artificial intelligence platforms. This development poses a heightened risk, potentially compromising personal AI accounts and corporate development environments by exposing proprietary prompts, code, and operational data.

Infection Vector and Stealthy Deployment

The typical infection chain for Remus begins with social engineering, primarily through a method known as ClickFix. Victims are presented with deceptive CAPTCHA prompts, often delivered via malicious emails, advertisements, or compromised websites. These prompts manipulate users into manually executing a command, which then initiates the malware’s deployment.

This human-driven execution step effectively circumvents many automated security measures designed to block suspicious downloads, providing Remus with an unobserved pathway onto Windows devices. This initial bypass is critical to its operational success.

Comprehensive Data Exfiltration Capabilities

SpyCloud said in a report that its researchers conducted an in-depth reverse engineering analysis of Remus. Their investigation revealed that the malware actively targets data from 21 distinct web browsers and 16 cold cryptocurrency wallets. Notably, Remus also seeks out a wide selection of Mozilla Firefox extensions, including those commonly used for two-factor authentication (2FA).

The implications of a Remus compromise extend far beyond simple password resets. Stolen browser cookies can enable attackers to hijack active user sessions, while exfiltrated wallet data and saved login credentials can lead directly to financial losses. Furthermore, the theft of API tokens and AI assistant chat histories could expose sensitive internal prompts, proprietary code, confidential documents, and usage patterns, revealing information that organizations did not intend to leave the device.

Remus Infostealer Removes Syscall Hooks to Evade EDR

A key characteristic distinguishing Remus is its proactive approach to evading detection before initiating data collection. The malware leverages direct system calls to the Windows kernel for critical operations like file reading and writing. Crucially, prior to executing these actions, Remus scans for and removes any hooks present on these system calls. This tactic directly interferes with a fundamental mechanism used by Endpoint Detection and Response (EDR) tools to monitor programs for suspicious behavior.

To further obscure its activities, Remus does not store system-call numbers in plain text. Instead, these critical identifiers are maintained within an encrypted reference table, which is only decrypted in memory during the malware’s setup phase. This dynamic decryption significantly complicates static analysis, making it harder for security researchers and automated systems to understand its functionality.

This method of weakening system visibility mirrors advanced EDR evasion strategies observed in other recent campaigns, where attackers prioritize disabling or blinding security tools before proceeding with credential theft or other malicious objectives. Additionally, Remus utilizes generic Windows COM objects to profile infected devices, traverse shortcuts, and acquire files. Employing these common system components helps the malware blend in, making its activities appear less anomalous compared to commands executed through more conspicuous methods like PowerShell.

To thwart analysis, Remus also incorporates a simple sandbox detection mechanism. It checks for the presence of a file named [email protected] in Outlook storage directories. If this file is found, the malware can halt its execution, preventing it from running within an analysis environment.

The malware’s network communication design also enhances its resilience. Remus encrypts its command and control (C2) configuration and exfiltrates stolen data in multiple, smaller stages rather than a single large transfer. This segmented approach means that if defenders interrupt one stage, earlier collected data may still reach the operator. Smaller transfers are also less likely to trigger alerts in environments with limited network monitoring capabilities.

Credentials, Wallets, and AI Data at Risk

Once fully operational, Remus systematically targets Chromium and Mozilla-based browsers to extract cookies, saved passwords, extension data, and other profile information. Its extensive list of targeted extensions includes popular password managers, cryptocurrency wallet extensions, payment processing tools, note-taking utilities, and multi-factor authenticators.

The critical takeaway for users, especially those encountering fake CAPTCHA prompts, is that legitimate web verification should never require pasting commands into the Windows operating system. Such requests are a clear indicator of malicious intent.

Beyond browser data, Remus can also harvest information from remote access applications, VPN clients, cloud services, messaging platforms, and file-transfer utilities, along with files accessible via Windows shortcuts. For C2 communication, Remus employs EtherHiding, a technique that leverages an Ethereum smart contract to dynamically retrieve its server address. This blockchain-based method allows operators to modify their infrastructure without needing to update every infected machine, enhancing the malware’s persistence and adaptability.

What You Should Do

• Isolate Affected Endpoints: Immediately disconnect any suspected infected device from the network to prevent further compromise and lateral movement.
• Initiate Password Resets: Force a global password reset for all accounts, particularly those accessed from the compromised machine. Prioritize critical business accounts, email, and financial services.
• Revoke Sessions and API Tokens: Invalidate all active browser sessions and revoke any API tokens that may have been exposed. This is especially crucial for cloud services and AI platforms.
• Rotate Wallet Secrets: For cryptocurrency users, rotate or transfer assets from affected wallets and change associated secrets or seed phrases where applicable.
• Review Application Access: Conduct a comprehensive audit of application permissions and access logs for any unusual activity.
• Hunt for IoCs: Actively search for the provided Indicators of Compromise (IoCs) within your network, including the Ethereum smart contract addresses, RPC nodes, C2 server addresses (e.g., fightwa[.]biz:5902), and the sandbox detection filename honey@pot[.]com.pst.
• Monitor for Unusual Activity: Implement monitoring for unexpected clipboard-to-command activity, suspicious outbound connections from browser processes, and newly created files following any web verification prompts.
• Maintain Up-to-Date Protections: Ensure all endpoint protection, browser security, and Windows operating system updates are fully applied. Review and restrict browser extension access to sensitive data where possible.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.