A newly identified Remus Infostealer operation is leveraging SEO-optimized websites that advertise fake cracked software for infection purposes. The campaign targets Turkish-speaking users, infecting browsers and accessing gaming sessions, FTP credentials, clipboard contents, screenshots, and email storage files. Notably, the malware employs an Ethereum smart contract to dynamically retrieve its C2 address via a technique called EtherHiding, offering operators a more resilient infrastructure while reducing vulnerability to domain takedowns.
Researchers Dor Levy and Brian Janower observed Remus being delivered through a network of malicious websites that impersonate cracked productivity software, games, and applications.
One lure was disguised as a cracked PDF reader archive titled “İndir – Full.” The term “İndir” means download in Turkish, while “Türkçe” and “Yama” are commonly used in Turkish piracy-related search terms and software listings. By operating inside the browser process, the malware can access sensitive information stored in browser vaults, including saved passwords, cookies, browsing data, and encryption material. It targets local data associated with password managers, cryptocurrency wallet browser extensions, and popular FTP clients.
Public analysis of Remus reveals that this model involves the malware sending a JSON-RPC eth_call request to a hardcoded Ethereum contract, decoding a hex-encoded response, and utilizing it to identify its live C2 server.
