Remus Malware Spreads Through Fake Software Sites, Targets Web Browsers

A new information-stealing malware called Remus has been discovered, targeting Windows systems and compromising popular web browsers. The malware is spread through fake cracked software sites that trick users into downloading infected files.

Once installed, Remus focuses on browser vaults and online-account data, turning everyday browsing into a serious exposure risk. It can access browser vaults directly, harvesting saved passwords, session cookies, and sensitive data that would normally be locked behind encryption on disk.

The malware also reaches into password managers, FTP clients, clipboard contents, screenshots, and enterprise email storage files, giving attackers a broad snapshot of the victim's digital life. The stolen information is then sent to an Ethereum smart contract, which returns a live C2 URL for exfiltration.