Remus Stealer · 64bit evolution of Lumma
Source Reddit Malware
Discussion
Remus Stealer is a 64-bit malware-as-a-service infostealer that emerged in 2026 as an evolution of Lumma Stealer. It targets credentials, browser cookies, authentication tokens, and cryptocurrency wallets, with a notable capability to steal active session cookies to bypass multi-factor authentication. The malware employs advanced evasion techniques including EtherHiding, which stores command-and-control addresses in Ethereum smart contracts to evade takedown efforts, and enhanced anti-analysis features such as sandbox DLL checks and honeypot detection. Infection vectors include phishing, fake software downloads, malvertising, fake CAPTCHA campaigns, SEO poisoning, and fake GitHub projects. It targets sectors such as financial services, healthcare, government, technology firms, and managed service providers. No official patch or remediation is indicated, and no known exploits in the wild have been reported yet.
r/Malware (opens in a new tab)u/rifteyy_0 points0 comments
Remus Stealer is a rapidly evolving Malware-as-a-Service infostealer that emerged in 2026.
Remus also shifted from Lumma's 32-bit architecture and traditional resolvers to 64-bit with EtherHiding and enhanced anti-analysis (e.g., sandbox DLL checks, PST honeypot detection).
- It utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns.
- The malware steals credentials, browser cookies, authentication tokens, and cryptocurrency wallet data.
- Session theft is one of Remus's most dangerous capabilities because it can bypass MFA by stealing active session cookies directly from browser memory.
- The malware shows strong technical similarities to Lumma Stealer and may represent its evolutionary successor.
- Financial services, healthcare, government, technology firms, and MSPs are particularly attractive targets.
- Common infection vectors include phishing, fake software downloads, malvertising, and fake CAPTCHA campaigns, as well as SEO poisoning and fake GitHub projects to trick tech-savvy users.
See whole ANY.RUN execution chain at https://app.any.run/tasks/ae43628b-9d56-4c43-abac-fae7266c749f/
Check out whole malware analysis report at https://any.run/malware-trends/remus/
Links cited in the discussion
Also discussed in r/cybersecurity