MyCERT warns of password-stealing malware on office PCs

MyCERT, Malaysia's national cyber emergency team, published a warning on 14 November 2026 about password-stealing malware on Windows PCs. It names Remus Stealer, Lumma, RedLine, Agent Tesla, FormBook and StealC, and says these families are still active against Malaysian organisations and individuals. MyCERT rates the risk as high. If staff download software or follow pop-up instructions, read the steps below.

What this malware does

Once it runs on a PC, it copies what the browser has saved: passwords, the cookies that keep you signed in, password manager data and two-step login secrets kept in browser extensions. It also takes documents and details about the computer. With those cookies an attacker can open your email or online accounts without knowing the password.

MyCERT notes that the newest Remus version is sold with a feature to read the victim's Gmail inbox. Google says no Gmail flaw is involved: the attacker uses what was stolen from the infected PC.

How it gets onto a PC

MyCERT lists these ways in:

• Fake "verify you are human" or "something went wrong" boxes that tell you to paste a command into Windows. This trick is called ClickFix. See our earlier post: ClickFix scam: never paste a command from a website.
• Fake download sites that copy the look of free software pages.
• Poisoned search results and ads that lead to those fake sites.
• Email attachments, for example a disc image (ISO) file sent as an "invoice" or "order".

What to do

1. Tell staff: never paste a command that a website asks for, and download software only from the maker's own site or the Microsoft Store.
2. Do not open ISO or ZIP attachments from unknown senders. If a customer or supplier sends one you did not expect, call them first.
3. If you think a PC ran something it should not have, take it off the network and stop using it for logins until it has been cleaned or reinstalled.
4. From a different, clean device, change the passwords that were saved in that PC's browser, starting with email, banking and your website admin. Then sign out of all other sessions.
5. In Gmail or Outlook, check recent sign-in activity, forwarding rules and filters. An attacker often adds a rule that forwards your mail out.
6. Turn on two-step login or passkeys for email and banking. Remove saved passwords from browsers on shared office PCs.
7. Report an incident to MyCERT Cyber999 at 1-300-88-2999.

A spam and virus filter on company email stops many of the attachments these campaigns use. Our anti-spam email hosting page explains how it works for a small office.

Source and credit

We are sharing this news from MyCERT (CyberSecurity Malaysia). This summary is written by Synctech in our own words.

• MA-1508.112026: MyCERT Advisory - Infostealer Malware: Remus Stealer, Lumma, RedLine, Agent Tesla, FormBook and StealC, MyCERT, 14 November 2026: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=50bf495a-155f-4592-9559-2211e74327d7 Retrieved 14 Nov 2026. Gmail, Google, Outlook, Windows and Microsoft Store are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.