Remus Malware Hides Command Server on Ethereum, Exfiltrates Sensitive Data

Remus, a newly active information-stealing malware, has been quietly slipping into Windows systems and draining their saved passwords, cookies, and crypto wallet data. The latest campaign involves fake cracked software sites that look like ordinary download portals but are built to trick users searching for 'free' productivity tools and games.

Once installed, Remus focuses on browser vaults and online-account data, turning everyday browsing into a serious exposure risk. Researchers from Unit42 identified this activity and mapped how the operators rotate domains and IP addresses to keep the campaign alive despite takedowns.

The malware uses remote threads to inject into running Chromium-based browsers, accessing browser vaults directly and harvesting saved passwords, session cookies, and sensitive data. Stolen information does not travel to a fixed server; instead, Remus sends an on-chain lookup to a specific Ethereum smart contract and uses the returned data to decide where to exfiltrate the loot.

The result is a flexible command network that can pivot to new servers at short notice while keeping the malware code itself unchanged. This approach mirrors techniques seen in campaigns that use EtherHiding and other blockchain-backed C2 tricks, raising the bar for defenders who rely on simple domain blocking to cut off active threats.