CIS CTI traced Remus infostealer distribution from Mar-Sep 2026, linking its MaaS ops to browser-session theft, EtherHiding C2 rotation, and multiple delivery chains tied to the Lumma lineage. #Remus #LummaStealer #EtherHiding