Remus Infostealer Evades EDR by Removing Syscall Hooks, Targets AI Credentials
The Remus infostealer, active since March 2026, employs sophisticated techniques to bypass endpoint detection and response (EDR) systems before stealing credentials from browsers, cryptocurrency wallets, and increasingly, AI tools.
The Remus infostealer, first observed on underground marketplaces in March 2026, has emerged as a significant threat to Windows systems. This information stealer is designed to pilfer sensitive data, including credentials from web browsers, cryptocurrency wallets, and even AI tools, posing a risk to both personal accounts and corporate development environments. Its distribution often begins with social engineering tactics, such as fake CAPTCHA prompts delivered via email, malicious advertisements, or compromised websites, tricking users into executing commands themselves. This human-initiated step can bypass automated defenses, providing a stealthy entry point for the malware.
Researchers at SpyCloud have conducted an in-depth analysis of Remus, revealing its extensive capabilities. The malware targets data from 21 different browsers and 16 types of cold cryptocurrency wallets. Notably, it also collects a wide array of data from Mozilla extensions, including those used for two-factor authentication. The implications of such data theft extend beyond simple password resets; stolen session cookies can allow attackers to hijack active browser sessions, while compromised wallet credentials can lead to direct financial losses. Furthermore, the exfiltration of API tokens and AI assistant histories can expose internal prompts, proprietary code, sensitive documents, and usage patterns that organizations may not expect to leave their devices.
A key feature of Remus is its advanced evasion technique: it actively removes syscall hooks before initiating its data collection activities. System calls are direct requests to the Windows operating system for critical functions like file access. By removing hooks that endpoint detection and response (EDR) tools use to monitor suspicious behavior, Remus significantly reduces its visibility to security software. The malware stores system-call numbers in an encrypted reference table, decrypting them only in memory during its setup, which complicates static analysis and makes it harder for security tools to detect its actions.
This method of disabling security monitoring before proceeding with malicious actions aligns with tactics seen in other recent EDR evasion campaigns. Remus also leverages generic Windows COM objects to profile the target system, navigate file shortcuts, and access files, making its activities appear less anomalous than if it were to use more overt tools like PowerShell. To further evade detection in analysis environments, Remus performs a simple sandbox check by looking for a specific file, [email protected], within Outlook storage directories.
The malware's network infrastructure also incorporates resilience. Remus encrypts its command and control (C2) configuration and exfiltrates stolen data in small, segmented transfers rather than a single large data dump. This approach means that even if one stage of the data exfiltration is intercepted by defenders, the attacker may still retain data gathered in earlier stages. These smaller transfers are also less likely to trigger network monitoring alerts.
Remus's operational mechanism involves searching Chromium and Mozilla-based browsers for cookies, stored passwords, extension data, and other profile information. Its broad targeting of browser extensions includes password managers, wallet extensions, payment tools, note-taking utilities, and multi-factor authentication applications. The use of an Ethereum smart contract to dynamically retrieve C2 server addresses, a technique known as EtherHiding, allows attackers to alter their infrastructure without needing to update every infected machine, adding another layer of operational security for the threat actors.
Given the nature of Remus infections, organizations are advised to treat them as identity incidents rather than simple malware cleanups. Immediate steps should include isolating affected endpoints, resetting all exposed passwords, revoking active browser sessions and API tokens, and rotating any compromised wallet-related secrets. Security teams should actively hunt for the identified infrastructure, investigate any unusual clipboard-to-command activity, and ensure all endpoint, browser, and operating system protections are up-to-date. Furthermore, vigilance regarding browser extension access, outbound connections from browser processes, and files created following user interaction with verification prompts is crucial.