Tag: acrstealer

7 Attack Reports | 0 Vulnerabilities

Attack reports

May 2026 Infostealer Trend Report

This analysis covers infostealer distribution trends observed during May 2026, based on automated collection systems and diagnostic logs. Distribution occurred primarily through illegal software disguised as cracks and keygens, as well as email campaigns. ACRStealer, Remus, and LummaC2 were most pr…
lummac2
infostealer
credential theft
vidar
clickfix
dll side-loading
agenttesla
acrstealer
darkcloud
remus
2026-06-18
Published: June 18, 2026
Downloadable IOCs: 3

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

Threat actors exploited the EtherHiding technique to store ClearFake payload routing instructions within smart contracts on the BNB Smart Chain testnet, creating an immutable command-and-control infrastructure that cannot be taken down. The attack began with injected JavaScript on a compromised Swi…
infostealer
clickfix
sectoprat
clearfake
acrstealer
bnb smart chain
etherhiding
2026-05-26
blockchain c&c
Published: May 26, 2026
Downloadable IOCs: 4

Endgame Harvesting: Inside ACRStealer's Modern Infrastructure

ACRStealer, a sophisticated Malware as a Service, has evolved with enhanced evasion techniques and C2 communication strategies. It employs low-level syscalls and AFD for stealthy operations, bypassing user-mode hooks. The malware uses layered communication, establishing raw TCP connections followed…
evasion
data-theft
hijackloader
maas
lummastealer
acrstealer
c2-communication
syscalls
2026-03-17
browser-exploitation
gaming-malware
Published: March 17, 2026
Downloadable IOCs: 3

December 2025 Infostealer Trend Report

This analysis examines Infostealer malware trends during December 2025, focusing on distribution methods, volume, and disguising techniques. Key findings include the prevalence of ACRStealer, LummaC2, and Stealc Infostealers, with malware primarily distributed through SEO poisoning and compromised …
lummac2
infostealer
seo poisoning
dll sideloading
stealc
cryptocurrency theft
tor
acrstealer
2026-01-16
pyagent
python abuse
toragent
Published: January 16, 2026
Downloadable IOCs: 9

August 2025 Infostealer Trend Report

This analysis examines Infostealer trends in August 2025, focusing on distribution volume, methods, and disguises. AhnLab's automated systems collect and analyze malware, providing real-time IOC services. Infostealers, often disguised as cracks, are distributed through SEO poisoning. Notable varian…
lummac2
rhadamanthys
infostealer
seo poisoning
dll-sideloading
acrstealer
slack
2025-09-16
domain masquerading
Published: September 16, 2025
Downloadable IOCs: 0

New Variant of ACRStealer Actively Distributed with Modifications

A modified version of the ACRStealer infostealer is being actively distributed, featuring enhanced detection evasion and analysis obstruction techniques. The malware uses the Heaven's Gate technique for executing x64 code in WoW64 processes and implements low-level NT functions for C2 communication…
infostealer
anti-analysis
c2 communication
heaven's gate
acrstealer
2025-08-21
data encryption
detection evasion
amaterastealer
Published: August 21, 2025
Downloadable IOCs: 0

June 2025 Infostealer Trend Report

This analysis provides insights into Infostealer malware trends observed in June 2025. The data, collected through various automated systems, reveals changes in distribution methods and malware types. While LummaC2 has been dominant, June saw increased activity from Rhadamanthys, ACRStealer, Vidar,…
lummac2
rhadamanthys
infostealer
seo poisoning
vidar
stealc
dll-sideloading
2025-07-16
acrstealer
anti-analysis techniques
Published: July 16, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports