RemusStealer is a Go-based malware-as-a-service program designed to steal credentials and system information. It exhibits anti-virtual machine detection, bypasses Application-Bound Encryption, and performs detailed system discovery including antivirus, hardware, and OS data collection. Unlike similar malware that uses Steam or Telegram for C2, RemusStealer uses Ethereum smart contracts for command and control, representing an evolution in attacker sophistication by leveraging blockchain technology. It employs hidden desktop environments and launches browser processes on non-primary window stations to evade detection and steal credential files. The malware communicates with suspicious domains ending in .shop or .biz and interacts with Ethereum-related infrastructure for C2.

The malware enables attackers to steal credentials and system information stealthily, potentially compromising user accounts and sensitive data. Its use of Ethereum smart contracts for C2 communications complicates detection and attribution. The hidden desktop technique and launching of browsers on non-primary window stations increase its ability to evade security controls. There are no reports of active exploitation in the wild at this time.

No official patches or vendor advisories are available for RemusStealer. Defenders should monitor for indicators such as connections to suspicious .shop or .biz domains (e.g., shivlpf.shop) and unusual browser processes running on non-primary window stations. Employ endpoint detection tools capable of identifying hidden desktop environments and credential theft behaviors. Since this is malware, standard endpoint protection and threat intelligence updates are recommended. Patch status is not applicable.