Commercial Push and Early Features
A new infostealer malware called REMUS has been actively marketed and developed across cybercrime forums since February 2026, according to an analysis by Flare researchers. The study examined 128 posts related to the REMUS operation over a three month period, revealing a highly commercialized malware as a service (MaaS) platform. Initial advertisements in February emphasized ease of use, with the operator claiming a 90 percent callback rate with proper crypting. The early feature set included browser credential theft, cookie collection, Discord token theft, and Telegram based log delivery, with the operator boasting 24/7 support and a user friendly interface.
Rapid Development and Platform Evolution
March 2026 marked the most intense development period, with the operator introducing restore token functionality, worker tracking, statistics pages, and duplicate log filtering. These updates moved beyond simple theft capabilities toward operational visibility and campaign management. April saw a strategic shift toward session continuity, with additions such as SOCKS5 proxy support, anti VM toggles, gaming platform targeting, and password manager collection. One update specifically added IndexedDB collection for 1Password and LastPass extensions. By May 2026, the development cycle shifted to refinement and stabilization, focusing on bug fixes and collection optimizations rather than new features.
Connection to Lumma and Commercial Strategy
While technical analyses have highlighted REMUS as a 64 bit variant of Lumma Stealer with similar anti VM checks and browser encryption bypass techniques, the underground activity reveals a broader commercial strategy. The operator posts depict a structured software business with continuous development cycles and customer focused updates. This approach shows how modern MaaS operations have evolved beyond distributing static malware builds into actively maintained platforms that prioritize usability, persistence, and long term monetization through ongoing feature releases and operational refinements.
Source: BleepingComputer
