Family comparison

RemusLumma StealerVidar
Capability
RemusActive
Lumma StealerActive
VidarActive
PlatformWindowsWindowsWindows
Dark Radar infection records269,9226,485,6185,662,081
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessions—Reported—
AutofillDark Radar observationVerifiedVerified
macOS Keychain———
2FA and password managers—VerifiedVerified
Financial
Saved cardsDark Radar observationVerifiedVerified
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerifiedVerified
Clipboard address replacement———
Applications
Email clients—Version-dependent—
FTP clients——Version-dependent
VPN clients———
Messaging applicationsDark Radar observationVersion-dependentVersion-dependent
Gaming platformsDark Radar observationDark Radar observationDark Radar observation
System
File collection—VerifiedVerified
Screenshot——Verified
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload download—VerifiedVerified
Persistence———
Anti-analysisVerifiedVerifiedVerified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed