Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials

Remus is a Windows information stealer that is gaining attention for the way it hides before taking data. The malware surfaced on underground marketplaces in March 2026 and is built to collect browser information, cryptocurrency wallet data, passwords, and files from compromised computers.

Its newer versions also seek credentials linked to AI tools, putting personal accounts and corporate development environments at risk.

The infection commonly begins with ClickFix social engineering. Victims encounter a fake CAPTCHA through email, malicious advertising, or a compromised website, then are persuaded to run a command themselves.

That human step can bypass protections designed to stop suspicious downloads, and it gives the stealer a quiet route onto Windows devices.

SpyCloud said in a report shared with Cyber Security News (CSN) that its researchers spent weeks reverse engineering Remus. The investigation found that the malware targets data from 21 browsers and 16 cold wallets, while also collecting a notably broad selection of Mozilla extensions, including extensions used for two factor authentication.

The risk extends beyond a single password reset. Stolen cookies can help attackers take over active browser sessions, while wallet data and saved logins can lead to direct financial loss.

API tokens and AI assistant histories may expose internal prompts, code, documents, and usage information that organizations did not expect to leave the device.

Remus Infostealer Removes Syscall Hooks

Remus tries to reduce scrutiny before it begins its collection work. It uses system calls, which are direct requests to Windows, for sensitive actions such as reading and writing files.

Before doing so, it scans for and removes hooks on these calls, interfering with a common way endpoint detection and response tools watch programs for suspicious behavior.

Instead of leaving system-call numbers plainly visible, the malware keeps them in a reference table that it decrypts in memory during setup. This makes static inspection more difficult.

The approach echoes tactics seen in recent EDR evasion campaigns, where attackers aim to weaken visibility before moving to credential theft or other harmful activity.

The stealer also uses generic Windows COM objects to profile a device, follow shortcuts, and obtain files. Those ordinary software components can make activity appear less unusual than commands launched through PowerShell.

Remus checks Outlook storage for a file named [email protected] as a simple sandbox test, then can avoid running in an analysis environment.

Its network design adds another layer of resilience. Remus encrypts its command configuration and sends stolen material in separate, smaller stages rather than one large transfer.

If defenders interrupt one stage, an operator may still receive data gathered earlier. Smaller transfers may also be less conspicuous in environments with limited network monitoring.

Credentials, Wallets, and AI Data

Once active, Remus searches Chromium and Mozilla based browsers for cookies, stored passwords, extension data, and other profile material.

Its wide extension list includes password managers, wallet extensions, payment tools, note taking utilities, and authenticators.

Readers following fake CAPTCHA malware delivery should recognize the central lesson: a web verification check should never require someone to paste a command into Windows.

The malware can also gather data from remote access, VPN, cloud, messaging, and file-transfer applications, alongside files reached through Windows shortcuts.

It communicates with a changing server address obtained through an Ethereum smart contract, a method called EtherHiding. Similar blockchain based delivery methods let operators alter their infrastructure without updating every infected machine.

Organizations should treat a suspected Remus infection as an identity incident, not merely a malware cleanup. Isolate the endpoint, reset exposed passwords, revoke browser sessions and API tokens, rotate wallet-related secrets where appropriate, and review application access.

Security teams should hunt for the listed infrastructure, investigate unexpected clipboard-to-command activity, and keep endpoint, browser, and Windows protections fully updated.

They should also examine browser extension access, outbound connections from browser processes, and files created after a verification prompt.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials appeared first on Cyber Security News.