Remus Stealer: Lumma's Successor Hides Its C2 on Ethereum, Steals AI Coding-Agent Keys and Sells a Gmail-Access Tier

High · 2026-11-11 · By H.A

Remus, a Lumma-derived Windows infostealer sold since March 2026, spreads via ClickFix lures, resolves its C2 through an Ethereum smart contract, and steals browser sessions, wallets, 2FA extensions and AI tool API keys; its newest version claims password-proof Gmail access.

Overview

Remus is a 64-bit Windows information stealer sold as malware-as-a-service on underground forums. It first appeared publicly around March 2026 and has kept evolving ever since. Researchers who took it apart describe it as heavily inspired by, or derived from, the Lumma Stealer codebase. Lumma was the most widely used stealer until its infrastructure was disrupted and its panel exposed in 2025.

Three things make Remus worth tracking now:

• Its C2 lives on a blockchain. Remus looks up its live command-and-control address in an Ethereum smart contract ("EtherHiding"). Seizing or sinkholing a domain does not cut infected machines off.
• It goes after AI developer credentials. Recent builds collect the local credential folders of AI coding tools, including Claude Code, Codex, Cursor and OpenCode. That exposes API keys and usage history.
• The seller is now advertising Gmail takeover. Version 1.3.9 is pitched as letting operators read a victim's Gmail from the panel, including verification codes and recovery links. The seller claims this access survives a password change. That claim has not been independently verified.

The Threat

Remus is a full-featured stealer. Its default target lists cover:

• Browsers: 21 browsers, from Chrome, Edge, Brave, Opera and Vivaldi to Firefox, Thunderbird, Waterfox, Zen and Floorp. It steals saved passwords, cookies, session tokens, autofill and history.
• Crypto: about 20 desktop wallets, such as Exodus, Electrum, Ledger Live and Sparrow, and a long list of wallet extensions, such as MetaMask, Phantom and Trust Wallet.
• 2FA and password managers: browser authenticator extensions (Google Authenticator, Authy, 2FAS and others) and password managers (Bitwarden, LastPass, KeePassXC, Proton Pass, 1Password, NordPass).
• AI tools: credential and history folders of AI coding assistants and command-line agents.
• Everything else: Telegram, Discord, VPN and FTP clients, AnyDesk and VNC settings, Outlook profile data, gaming accounts, the clipboard, screenshots, and any files the operator names by path or wildcard. It even follows .lnk shortcuts to find the real files.

Pricing follows the Lumma model, with three tiers advertised at $250, $500 and $1,000. The top tier carries the Gmail-reading feature. The developer insists Remus is not a Lumma rebrand. Researchers point to shared panel design, the same log-folder layout, an identical "unpacked build" warning and the same obfuscation routines. They also note that Remus extracts Chrome's master key in almost exactly the way Lumma did.

Timeline

• 25 February 2026: the Ethereum contract later used to hand out Remus C2 addresses is created.
• March 2026: Remus is first advertised for sale. An independent analyst publishes the first technical write-up, of a sample built on 19 March.
• July 2026: researchers publish the code and panel comparison that ties Remus to the Lumma lineage.
• September 2026: a deep-dive analysis documents the AI-credential theft, the syscall unhooking and the step-by-step encrypted exfiltration.
• Late October – early November 2026: fresh Remus samples keep appearing in public sandboxes. Version 1.3.9 is advertised with the persistent Gmail access feature.

Tradecraft

Delivery. The most common lure is ClickFix: a fake CAPTCHA or "verify you are human" page tells the visitor to paste a command into the Windows Run box or a terminal. Victims reach these pages through malicious ads, compromised websites and phishing emails. Remus is also spread through fake software download sites, cracked software and loader malware.

Evasion.

• The code is protected with a private fork of the OLLVM obfuscator: encrypted strings, scrambled arithmetic and control flow hidden behind indirect jumps.
• Before doing anything noisy, it removes security-product hooks from system calls. It then uses direct syscalls, whose numbers are stored in an encrypted table and looked up by hash.
• It profiles the machine and lists installed antivirus through COM objects rather than PowerShell or the registry, which is quieter.
• Anti-sandbox check: it exits if an Outlook data file named honey@pot.com.pst exists. Some builds also use a RunAsInvoker compatibility trick to avoid UAC prompts, and load a second stage disguised as sechost.dll in memory only.
• It refuses to run unpacked, the same safety check Lumma used.

Command and control.

1. It tries a built-in list of domain:port pairs, usually on unusual high ports.
2. It then sends a JSON-RPC request to a public Ethereum node and reads the current C2 address from a smart contract. If that fails, it quits.
3. It obtains an access token, downloads an encrypted configuration and sends stolen data back step by step (a step= parameter, ChaCha20-encrypted). Operators keep whatever was collected even if the infection is caught halfway.

IOCs

Infrastructure rotates often. Treat these as hunting leads and historical context, not a complete block list. Values are defanged.

Blockchain C2 resolution

• Ethereum contract (C2 resolver, "DomainStorage"): 0x999941b74F6bbc921D5174A5b29911562cd2D7CF
• Contract owner wallet: 0xBeCFC3F9EB36E6Ec0E54f7A6627DA7EF648f8F01
• Public RPC endpoints queried (legitimate services: alert on them, don't blindly block): ethereum-rpc[.]publicnode[.]com, eth[.]llamarpc[.]com

C2 domains and IPs (2026)

• fightwa[.]biz:5902
• adveryx[.]biz (76.13.17[.]11:6573)
• coox[.]live (168.231.114[.]49:28313)
• padaz[.]pics (103.211.219[.]238:4219)
• nitroca[.]biz (62.72.32[.]156:6782)
• chalx[.]live (62.72.32[.]156:5902)
• baxe[.]pics (65.21.104[.]235:48261)
• buccstanor[.]pics / gluckcreek[.]online (94.231.205[.]229:48261)

File hashes (SHA-256)

• Stage 1: cfcb21d8df942918f7a74b99f2cccf7e54e2a6dd1ea6de60897ff0026a26b5c4
• Stage 2 (sechost.dll lookalike): 352721b32ec1c8349985ceccfec8d1ca6e3e6cc12f83350c4ae1a75477588bc2

Host artefacts

• String REMUS LOG in memory or in the staged log
• Checks for honey@pot.com.pst under the Outlook folder
• __COMPAT_LAYER=RunAsInvoker set for a child process
• A sechost.dll loaded from outside System32

Detection

• Ethereum lookups from odd processes. Alert when anything other than a browser or a known wallet or developer tool makes HTTPS requests to public Ethereum RPC endpoints. On an office PC this is rare and a strong signal.
• ClickFix execution. Hunt for powershell, mshta, cmd or rundll32 launched from explorer.exe with a long command line right after the Run dialog was used (RunMRU registry entries). Also look for powershell -exec bypass and rundll32 loading a DLL from the user profile.
• Credential-store access. Flag non-browser processes reading browser Login Data, Cookies, Local State, Firefox logins.json/cookies.sqlite, wallet folders, or the config folders of AI coding tools.
• Exfiltration pattern. Look for repeated HTTP POSTs to raw high ports (4219, 5902, 6573, 6782, 28313, 48261 have been seen) with a step= parameter, sent soon after a new process started.
• Unhooking. EDR telemetry about restored ntdll sections or direct syscalls from an unsigned user-profile binary deserves a closer look.

Recommended Actions

1. Close the ClickFix door. Teach users that no real CAPTCHA asks them to paste commands. Where possible, disable the Run dialog for standard users and restrict PowerShell (Constrained Language Mode, script-block logging).
2. On any confirmed infection, assume every credential on that machine is stolen. From a clean device: change passwords, sign out all sessions (Google, Microsoft, social and banking accounts), and re-enrol MFA. Only then move funds out of any hot wallet.
3. Check Gmail and Google accounts directly. Review signed-in devices, third-party app access, forwarding rules, filters, delegates and recovery details. Remove anything you did not set up yourself.
4. Rotate developer and AI secrets. Revoke and reissue API keys for AI services, cloud keys, Git tokens and SSH keys stored on the host. Check AI provider usage dashboards for unexpected spend.
5. Reimage the device instead of cleaning it. Remus loads code into memory and may have pulled in other payloads.
6. Reduce what a stealer can grab. Don't keep passwords in the browser on shared or high-risk machines. Prefer hardware-backed MFA (passkeys or security keys) over browser-extension authenticators. Keep AI tool credentials in an OS keychain or a secrets manager rather than plain config files.

Analyst Assessment

Remus fills the gap Lumma left behind. It reuses a proven codebase and business model, then makes it harder to dismantle. Blockchain-based C2 lookups mean domain takedowns alone will not stop it, so detection on the endpoint and quick credential revocation matter more than blocklists.

The move into AI coding-tool credentials is the trend to watch. Those folders often hold long-lived API keys with billing attached and access to source code, and few organisations monitor them. We rate the threat High. It is actively sold and updated, spreads through ClickFix lures that bypass email filters, and reaches the session tokens that turn one infected laptop into a cloud, email and wallet compromise. Its claim of password-proof Gmail access is not verified. Until it is, the safe reading is that stolen session data is being reused, and the fix is the same: revoke every session, not just the password.