Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution

Flare's analysis examines the REMUS infostealer and the underground MaaS operation behind it, documenting a rapid development cycle from February–May 2026 that added browser credential and cookie theft, token restoration, SOCKS5/proxy support, IndexedDB collection targeting password managers (1Password, LastPass, Bitwarden), and operational tooling (dashboards, worker tracking, delivery optimizations). The report highlights a shift from simple credential harvesting toward session theft and authenticated-session monetization, noting REMUS's commercialization, operational maturity, and focus on preserving and restoring authenticated access to bypass MFA and other protections.