#remcos

Remcos (Remote Control and Surveillance) is a commercial Remote Access Tool sold by Breaking Security. It is marketed for legitimate remote-administration use but pirated and cracked builds are widely abused in financially-motivated phishing campaigns. MITRE ATT&CK tracks it as S0332. Capabilities include keylogging, screen capture, file management, microphone and webcam access.

Most commonly as a second stage from phishing emails - invoice, shipping, DHL or banking lures. The first-stage loader is typically a malicious Office macro, an ISO / IMG container or an AutoIt-compiled dropper. Latin American, European and English-speaking SMB users are the most frequently targeted demographics in current campaigns.

Every 15 minutes. The TweetFeed pipeline scrapes RSS feeds from public Twitter/X security researcher accounts and lists, extracts IOCs, tags them with the relevant malware family or threat actor, and republishes the result in CSV, JSON and RSS. Remcos-tagged IOCs are surfaced on this page within the next 15-minute tick. The page itself is regenerated daily by a GitHub Action.

All TweetFeed IOC data, including this Remcos subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.