Opening SecureFlowRemus: Infostealers Target AI Client Credentials and Local History
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

SpyCloud Labs aidefend-sf0065

Remus: Infostealers Target AI Client Credentials and Local History

  • AI Infrastructure
  • Credential & Identity Theft
  • Data Exfiltration

Remus is Windows malware that steals application data after gaining execution on a device. SpyCloud identified AI-client directories among its configurable collection targets, including Codex, Cursor and OpenCode. The AI-security exposure is reusable credentials and locally retained activity data; protecting an agent tool alone does not contain malware already running elsewhere on the host.

Mapped threat techniques

  • AML.T0083 Credentials from AI Agent Configuration
  • AML.T0025 Exfiltration via Cyber Means

Source

Updated