Remus Hides Its Command Server on Ethereum While Emptying Browser Vaults

Remus is an active Windows infostealer distributed through SEO‑poisoned warez storefronts (notably Turkish‑language fake cracked software sites) that injects into Chromium‑based browsers to steal saved passwords, cookies, crypto extension data, clipboard contents, FTP credentials, screenshots and email storage. The malware resolves its command-and-control dynamically by querying an Ethereum smart contract for the live C2 URL, then exfiltrates data via HTTP POSTs to rotating domains/IPs (numerous IoCs and SHA256 samples are provided); defenders are advised to block listed domains/IPs, monitor for process injection and unusual blockchain RPC requests, and avoid pirated software.