Remus Stealer: Lumma's Successor Hides Its C2 on Ethereum, Steals AI Coding-Agent Keys and Sells a Gmail-Access Tier

High · 2026-11-11 · By H.A

Remus Stealer: Lumma's Successor Hides Its C2 on Ethereum, Steals AI Coding-Agent Keys and Sells a Gmail-Access Tier

Remus, a Lumma-derived Windows infostealer sold since March 2026, spreads via ClickFix lures, resolves its C2 through an Ethereum smart contract, and steals browser sessions, wallets, 2FA extensions and AI tool API keys; its newest version claims password-proof Gmail access.

Overview

Remus is a 64-bit Windows information stealer sold as malware-as-a-service on underground forums. It first appeared publicly around March 2026 and has kept evolving ever since. Researchers who took it apart describe it as heavily inspired by, or derived from, the Lumma Stealer codebase. Lumma was the most widely used stealer until its infrastructure was disrupted and its panel exposed in 2025.

Three things make Remus worth tracking now:

The Threat

Remus is a full-featured stealer. Its default target lists cover:

Pricing follows the Lumma model, with three tiers advertised at $250, $500 and $1,000. The top tier carries the Gmail-reading feature. The developer insists Remus is not a Lumma rebrand. Researchers point to shared panel design, the same log-folder layout, an identical "unpacked build" warning and the same obfuscation routines. They also note that Remus extracts Chrome's master key in almost exactly the way Lumma did.

Timeline

Tradecraft

Delivery. The most common lure is ClickFix: a fake CAPTCHA or "verify you are human" page tells the visitor to paste a command into the Windows Run box or a terminal. Victims reach these pages through malicious ads, compromised websites and phishing emails. Remus is also spread through fake software download sites, cracked software and loader malware.

Evasion.

Command and control.

  1. It tries a built-in list of domain:port pairs, usually on unusual high ports.
  2. It then sends a JSON-RPC request to a public Ethereum node and reads the current C2 address from a smart contract. If that fails, it quits.
  3. It obtains an access token, downloads an encrypted configuration and sends stolen data back step by step (a step= parameter, ChaCha20-encrypted). Operators keep whatever was collected even if the infection is caught halfway.

IOCs

Infrastructure rotates often. Treat these as hunting leads and historical context, not a complete block list. Values are defanged.

Blockchain C2 resolution

C2 domains and IPs (2026)

File hashes (SHA-256)

Host artefacts

Detection

Recommended Actions

  1. Close the ClickFix door. Teach users that no real CAPTCHA asks them to paste commands. Where possible, disable the Run dialog for standard users and restrict PowerShell (Constrained Language Mode, script-block logging).
  2. On any confirmed infection, assume every credential on that machine is stolen. From a clean device: change passwords, sign out all sessions (Google, Microsoft, social and banking accounts), and re-enrol MFA. Only then move funds out of any hot wallet.
  3. Check Gmail and Google accounts directly. Review signed-in devices, third-party app access, forwarding rules, filters, delegates and recovery details. Remove anything you did not set up yourself.
  4. Rotate developer and AI secrets. Revoke and reissue API keys for AI services, cloud keys, Git tokens and SSH keys stored on the host. Check AI provider usage dashboards for unexpected spend.
  5. Reimage the device instead of cleaning it. Remus loads code into memory and may have pulled in other payloads.
  6. Reduce what a stealer can grab. Don't keep passwords in the browser on shared or high-risk machines. Prefer hardware-backed MFA (passkeys or security keys) over browser-extension authenticators. Keep AI tool credentials in an OS keychain or a secrets manager rather than plain config files.

Analyst Assessment

Remus fills the gap Lumma left behind. It reuses a proven codebase and business model, then makes it harder to dismantle. Blockchain-based C2 lookups mean domain takedowns alone will not stop it, so detection on the endpoint and quick credential revocation matter more than blocklists.

The move into AI coding-tool credentials is the trend to watch. Those folders often hold long-lived API keys with billing attached and access to source code, and few organisations monitor them. We rate the threat High. It is actively sold and updated, spreads through ClickFix lures that bypass email filters, and reaches the session tokens that turn one infected laptop into a cloud, email and wallet compromise. Its claim of password-proof Gmail access is not verified. Until it is, the safe reading is that stolen session data is being reused, and the fix is the same: revoke every session, not just the password.

REEF SENTINEL