Remus Infostealer Uses Ethereum "Etherhiding" to Steal AI Credentials

A new Windows infostealer called Remus has surfaced on cybercrime forums, and it’s raising alarm bells for a reason beyond the usual password-and-crypto playbook: it now harvests credentials tied to AI assistants like Anthropic’s Claude and OpenAI’s ChatGPT.

Researchers at SpyCloud Labs spent several weeks reverse engineering the malware after it appeared on underground marketplaces around March 2026, and their findings paint a picture of a stealer that’s both technically sophisticated and disturbingly comprehensive.

Remus Infostealer uses Ethereum-based “Etherhiding” techniques to secretly steal AI credentials, cryptocurrency wallet information, and other sensitive data from victims.

Remus Infostealer Uses Ethereum

Remus targets data from 21 browsers and 16 cold wallets, but what sets it apart is its appetite for AI credential folders. Recent builds pull API tokens and LLM usage history from AI coding and chat tools, meaning a single infection could hand attackers access to a victim’s cloud AI accounts, billing-linked API keys, and even historical prompt logs.

Remus also pulls an unusually large set of Mozilla Firefox extensions, including several two-factor authentication tools, which could let attackers bypass MFA protections entirely if they capture the underlying secrets.

The infection largely relies on ClickFix-style social engineering, where fake CAPTCHA popups on malvertising or compromised sites trick victims into copy-pasting and running malicious commands themselves.

Remus Infostealer Uses Ethereum "Etherhiding" to Steal AI Credentials, Wallets

Remus doesn’t just steal quietly it actively works to disable the tools watching it. Before running any sensitive action, it performs a syscall hook sweep, stripping out any EDR hooks planted on the system, then executes its “loud” functions via direct syscalls referenced only by obfuscated hashes rather than plaintext service numbers.

It also abuses Windows COM objects to enumerate victim data and resolve shortcut files, a technique that flies under the radar of EDR tools tuned to flag more conventional PowerShell or API calls. A simpler but effective anti-analysis trick checks for a specific honeypot .pst file to detect sandboxed research environments before executing.

Notably, Remus shares its OLLVM-based string and arithmetic obfuscation routines, and even its Chromium credential-theft algorithm, with LummaC2 extracting the same wildcard memory pattern to locate the os_crypt Encryptor function and lift the protected master key.

Independent analysis from Gen Digital first flagged Remus as likely a 64-bit evolution of Lumma Stealer, reinforcing SpyCloud’s tooling-overlap findings.

Perhaps the most consequential technical shift is how Remus finds its live command server. Instead of hardcoding a C2 domain or relying on Steam and Telegram dead-drop resolvers like older stealer families, Remus sends a POST request to an Ethereum smart contract dubbed “DomainStorage” through a public RPC node, and receives back a live C2 URL in response.

SpyCloud observed the contract at address 0x999941b74F6bbc921D5174A5b29911562cd2D7CF returning the domain fightwa[.]biz:5902.

This dead-drop technique, known as etherhiding, was first popularized by North Korea-linked (DPRK) operators in 2025, and its adoption by a commodity crime-as-a-service stealer signals how quickly advanced nation-state tradecraft trickles down to the broader cybercriminal economy.

Because only the contract’s owner can update the stored address, operators can rotate infrastructure instantly without ever recompiling or redistributing the malware, making takedowns far less effective.

Data theft itself is encrypted end-to-end with ChaCha20 and exfiltrated in stages, each tagged with a “&step=” parameter, so operators retain partial loot even if detection interrupts an attack midway.

Remus’s targeting list spans password managers, VPN clients, FTP tools, cloud consoles like Azure and Google Cloud, and over 150 cryptocurrency wallet extensions a scope that reflects how infostealer-as-a-service operations are diversifying revenue streams beyond simple credential resale.

Security teams should watch for anomalous eth_call JSON-RPC traffic to public Ethereum endpoints from endpoints, a pattern with a notably low false-positive rate.

As AI tools become embedded in daily workflows, protecting API tokens and local credential stores tied to LLM platforms deserves the same rigor long applied to browser passwords and crypto wallets.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.