"With good crypting and a dedicated intermediary server, the callback rate is ~90%," the REMUS operator boasted in one of the earliest underground posts analyzed by Flare researchers — a claim that set the tone for a months-long push to commercialize and professionalize an infostealer that has been evolving rapidly since February 2026.
Flare's dataset: 128 underground posts, February 12–May 8, 2026
Flare researchers analyzed 128 posts tied to the REMUS operation between February 12 and May 8, 2026. The posts included advertisements, update logs, feature announcements, operational discussions, and customer-facing communications. That corpus tracks a compressed product cycle: initial marketing and capability claims in February, heavy feature expansion in March, a pivot to session persistence and password-manager collection in April, and refinement and stabilization into early May.
February: the commercial pitch — usability and reliability up front
The campaign began as a sale. Early posts stressed ease of use and customer support alongside technical features: browser credential theft, cookie collection, Discord token theft, Telegram delivery, and log management. The operator repeatedly framed REMUS as a turnkey product, advertising "24/7 support" and calling the interface "simple enough that even a child can figure it out." The 90% callback-rate claim — explicitly tied to "good crypting and a dedicated intermediary server" — was used to reassure prospective buyers about operational reliability.
March: turning a stealer into an operational platform
March was the busiest development month captured in the dataset. The operator moved beyond raw theft capabilities and added features aimed at campaign management and operational visibility: restore-token functionality, expanded log handling, worker tracking, statistics pages, duplicate-log filtering, and improved Telegram delivery workflows. Posts described enhancements such as worker nicknames in log tables and loader execution visibility to diagnose failed infections — signs that REMUS was being positioned as a managed platform with multi-user operational workflows rather than a single binary sold in isolation.
April–May: session continuity, IndexedDB collection, and password-manager focus
By April the campaign emphasized session continuity and browser-side authentication artifacts. The operator added SOCKS5 proxy support, improved token restoration workflows, anti-VM toggles, and explicit gaming-platform targeting. Notably, an update announced: "Added IndexedDB collection for 1Password and LastPass extensions," and others referenced Bitwarden-related searches. Multiple posts highlighted proxy-assisted restoration and support for multiple proxy types, underlining a shift toward preserving authenticated sessions — cookies and tokens that, according to the posts, can bypass multifactor protections.
REMUS's evolution toward IndexedDB and other browser-side storage collection reflects an intent to harvest browser application data and extension storage tied to password-management ecosystems. The posts do not claim vault decryption, but they show development moving toward collecting the browser-side artifacts associated with password managers.
How REMUS mirrors mature malware-as-a-service (MaaS) operations
The underground activity around REMUS reads less like scattered criminal postings and more like documented product releases. The operator published versioned updates, bug fixes, feature expansions, troubleshooting improvements, statistics enhancements, and platform-stability adjustments. References to workers, dashboards, loader monitoring, and log categorization imply a multi-operator environment with roles for development, infrastructure, delivery, and management. In short, the operation resembles a structured MaaS business with continuous development cycles and attention to usability, persistence, and long-term monetization.
What this means for security teams, gaming platforms, and end users
- Security teams and technologists: REMUS's emphasis on cookies, tokens, restore workflows, and proxy-assisted session recovery means defenders should look beyond username/password theft to browser-side artifacts and session persistence mechanisms when assessing exposure.
- Gaming platforms and online services (Discord, Steam, Riot Games): the operator explicitly targeted platforms where active sessions carry substantial value, signaling direct operational threats to services that rely on authenticated sessions for account access and in-game economies.
- End users: the campaign's stated focus on IndexedDB and browser extension storage tied to 1Password, LastPass, and Bitwarden highlights that local browser storage — not just passwords typed into forms — can be a target for theft and operational reuse.
Flare's investigators also note their own monitoring footprint: "Flare monitors millions of stealer logs across dark web markets and Telegram channels continuously," a capability the company frames as a way to detect exposed sessions and credentials before they are abused.
Across a three-month arc, the REMUS operation illustrates a broader point made in the underground posts themselves: infostealers are no longer single-purpose payloads but evolving platforms that prioritize session persistence, operational visibility, and commercial usability. As the operator shifted from rapid feature expansion to stabilization in early May, the campaign left one clear question for defenders and analysts alike — if commodity stealers now bake in session restoration, proxy support, and IndexedDB collection, how should detection and mitigation shift to account for browser-side artifacts and persistent authenticated sessions? The REMUS timeline suggests that answering that question will be essential to keep pace.
Source: Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution — BleepingComputer
