Remus Hides Its Command Server on Ethereum While Emptying Browser Vaults

Remus is a newly active information‑stealing malware that quietly slips into Windows systems, locks onto popular web browsers, and drains their saved passwords, cookies, and crypto wallet data. The latest campaign leans on fake cracked software sites that look like ordinary download portals but are built to trick users searching for “free” productivity tools and games. Once installed, Remus focuses on browser vaults and online‑account data, turning everyday browsing into a serious exposure risk. The current wave stands out because it combines aggressive SEO poisoning with a Turkish‑language warez storefront, using file names that include words like “İndir” and “Türkçe” to lure victims who are hunting for pirated software. Behind those download buttons, Remus is staged alongside other infostealers, showing that the same…