Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free TrialAttackers are leveraging infostealer malware-as-a-service (MaaS) for a variety of attacks, with malware of this nature showing up regularly in a variety of campaign types. ReversingLabs found several specific infostealers being used recently: AuraStealer, a very actively updated and maintained stealer with recently improved anti-analysis features, ACRStealer, a long standing malware family that has fallen in and out of use, and RemusStealer, a new potential variant on the infamous LummaStealer.
The samples covered were active in July through August of 2026. Here are the top infostealer MaaS trends, and the families that ReversingLabs has been researching. The goal is to provide readers with important knowledge of these threats, how they manifest, and what they are capable of — all of which is vital to know in the current threat landscape.
[ Get the report: Copy, Paste, Compromise: The Tale of ClickFix | See the webinar ]
Malware-as-a-service (MaaS) is becoming increasingly important in the security landscape. It lowers the barrier of entry for attackers, giving anyone access to malware without requiring coding knowledge. The MaaS market functions like any other market does, where the best products rise to the top. Vendors compete with each other to make the best products and grow their businesses. To engage in this massive market, potential customers can purchase subscriptions to the service, lifetime licenses, or join affiliate programs. Affiliate programs are common with ransomware-as-a-service, where the malware producer takes a cut of the earnings, and their customers, the ones doing the ransomware attack, take home the rest. The types of MaaS offered vary, with any type of malware being offered somewhere for a fee. Infostealers are especially popular, and are what this blog focuses on.
Infostealers do exactly what their name implies. Once installed, they take information from the device and exfiltrate it to the attacker. Common targets for infostealers include credentials, personal information, crypto wallet information, and session tokens. More specialized targets may include documents on the machine, clipboard data, recordings, browser cookies, or applications data. Since infostealers can exfiltrate a variety of things, attackers are able to leverage them in whatever way best suits their goals. These goals may be leaking documents with important corporate information, finding data to be used for blackmail, or compromising the logins for critical accounts. Any of these options could be disastrous for individuals or businesses. Whatever data the infostealer may be targeting, it is not information one would want to be revealed to threat actors.
Another important feature of infostealers, especially the popular ones operating as MaaS, is their stealth and evasion. Some infostealers, such as LummaStealer, use techniques like process hollowing and process injection. These techniques involve putting malicious code into an existing, trusted process, avoiding detection. Users on the device will not be able to detect infostealer activity easily, without knowing what to look for. Many infostealers have basic anti-analysis functionality, can detect antivirus, sandboxing, or use of VMs, and will terminate themselves if signs point to them being analyzed. AuraStealer, which will be discussed later, gives the user a prompt before continuing, which is likely meant to combat automated analysis.
Figure 1, Screenshot of prompt box asking user to enter a randomized string (pxDpRf) to continue.
Infostealers can delete themselves when finished, or will delete themselves upon detection of analysis tools and environments.
During the past few months, the threat research team at ReversingLabs has been investigating and reporting on various infostealers. Focus was put on families with significant recent activity, and researchers delved specifically into features of active strains. The following is a summary of the research into three specific families, AuraStealer, ACRStealer/Amatera, and Remus Stealer.
This trio of infostealers was specifically selected due to the recency of development and amount of use. ReversingLabs databases show that between June 1st and August 18th, AuraStealer had 26 samples submitted, ACRStealer had 397 (with an additional 81 for the related Amatera family) and Remus Stealer was the most prevalent with 606. Each of these counts are for unique executable samples that were submitted for the first time during the time frame.
Figure 2, A graph visualizing malware activity timeline for RemusStealer (red), AuraStealer (pink), ACRStealer (cyan), from June 1 to August 20 (Generated by Spectra Intelligence MCP).
AuraStealer and Remus Stealer are also newer families, having existed for less than a year, and don’t have as much data about them. The three are known for their ability to gather credentials from browsers and crypto wallets. All three are also tied to CIS countries and Russian language hacking forms, although there was no evidence found of direct relationships between the authors of these strains. They’re used in a variety of social engineering schemes, showing the vast array of potential attackers using these services.
AuraStealer is a relatively new player, emerging in July of 2025. It has gained significant momentum since. It is comparable to other infostealers, and while it doesn’t directly rip off any code, it functions similarly to its direct competitors. It seems to be positioning itself to overtake the niches of other popular infostealers, like its most direct competitor and comparison point, LummaStealer. In fact, many LummaStealer detections flag AuraStealer incorrectly, at least initially. It operated as a subscription model, with basic and premium tiers, which are charged on a monthly or yearly basis.
In practice, AuraStealer is used in a variety of attacks. Popular distribution methods leverage ClickFix and malicious short form videos. Researchers discovered that AuraStealer had a major transformation in summer of 2026 and this change brought virtualization. These virtualized files were directly observed by researchers at ReversingLabs. Virtualization is a technique that involves running custom commands through a virtual machine, which obfuscates and makes it harder to analyze. This change also immensely increased the filesize, bringing it from 500-700KB to 10MB.
ACRStealer is an interesting case. It’s been around for a while, starting out initially in 2018. From there, it acted as a low level infostealer, not earning much success. In 2022, they rebranded and significantly upgraded the malware. It went on for two years, but in the middle of 2024, the maintainers announced an indefinite hiatus. This hiatus would involve the continuation of ongoing subscriptions, but halted the process of onboarding any new affiliates. A few months after this announcement, a new malware emerged, labeling itself as Amatera. A specific management portal for Amatera was found, and the samples associated with the panel and the Amatera name were very similar to ACRStealer. Despite the distinction in name, the two families are very similar, and it is difficult to discern what differentiates the two. Both families are in use to this day.
Remus Stealer is the newest MaaS out of the three, having started at the very beginning of 2026. The first signs of Remus were in January and February, but researchers quickly caught onto it. What makes it compelling is the fact it seems to be a 64-bit variant of one of the most notorious infostealers: LummaStealer. LummaStealer is a flagship infostealer MaaS, maintaining prevalence even after a government raid of its infrastructure and the doxing of some of its key players. This comparison is drawn because Remus borrows a lot of Lumma’s traits, such as handling of string obfuscation, approach to application bound encryption (ABE) override, and design of control panels. Remus is unique for utilizing Etherhiding as a C2 communication method, a trait which Lumma does not have. Etherhiding uses Ethereum smart contracts to communicate their C2 domains, which is harder to detect, trace and block. The name “Remus” is derived from log identification strings in the code, and Lumma samples utilize a similar nomenclature with their own logs.
Reports emphasize Remus’s use in malvertising, SEO-poisoning and search redirection. It is also regularly used in ClickFix, fake reaCAPCTHA, and fake downloads. One particular campaign involved Traffic Distribution System (TDS) to make fake, malicious websites reach the top of Google search results for software related terms. These webpages would redirect into a Remus payload. Frequent organizational targets of Remus include healthcare, financial, government, MSPs, and tech, but it is also used in campaigns targeting individuals, especially through gaming communities. Currently, multiple loaders (Ameday, Gcleaner and OffLoader) are dropping Remus, and these samples utilize VMProtect or a Go-based delivery stage.
These families are delivered in a variety of ways. Being aware of potential vectors is a crucial step in staying safe. Social engineering is the typical means of getting MaaS onto victim devices. ClickFix and ClearFake are two popular methods attackers use to get victims to install malware. ClickFix is a social engineering technique designed to get a potential victim to run malicious commands on their own device. This typically occurs through malicious tech advice or fake reCAPTCHA verification. This technique is increasingly being seen on social media videos. ClearFake is a related technique, and has been consistently topping threat charts as something to look out for.
Leveraging Javascript, ClearFake campaigns are able to automate the process, either automatically putting the malicious command into the clipboard, or retrieving or running the malicious command upon interaction. Another frequently leveraged technique is SEO poisoning. It is mentioned regularly with Remus Stealer, but other families also leverage it. The technique involves designing malicious sites that appear at the top of search results, above legitimately relevant sites, to direct traffic to malicious sites.
Popular software and open source tools can be used as impersonation targets for these kinds of attacks. These are just a few examples of potential social engineering techniques, showing why it is important to stay cautious and skeptical when using the internet.
Infostealers are all too common nowadays, especially considering how dangerous they are. Once downloaded, they exfiltrate many kinds of data, giving the attackers access to user information, login credentials, session tokens, crypto wallets, and more. Since they have such clear ways to generate revenue, they are appealing to threat actors, driving demand in the MaaS market and encouraging malware authors to innovate in the space and improve their products.
AuraStealer, ACRStealer, and Remus Stealer are prime examples of active MaaS families. Each of them is unique in their own way, and sees different patterns of use. Being aware of different infostealer families is crucial to maintaining a safe environment. In addition, being wary of phishing schemes commonly associated with infostealer downloads is another way to prevent their installation.
Observed July 2026
5b5434cc8bb3556075c6967d2ffee5a6b33793de07b9d4701bc63d369de63861
bfad1100bc3054dd26151c7acea412960ece04c3aa075ba323c10cf75c31a9a4
b8663c9c2832b92095660d1c674835acb12804e56839451e6ad9e78ed3c6d5df
134ab4b33ab555f3a77d43e94891698834a9b739b065764a702c7c52e3f4c15b
a6382ab6244d3d36036280e1ec3e438f442759b6917e6bc19bcb29f1d3d7e9ee
3575caf8bd87912689ebb1d13770990248f93c5d882db8c849bee02cb7c0abad
93389f4234f81358fa29c65473b5bfc3c60ab7b3c2189185988f03a66aeda66f
01718933eb502e4ec9d4b1210a88cb026882d615605dd8d7fbf1c4057b7c0867
397566a51d405c351e5134650463d5872e218682f7f34a5f314539d087837ea4
3efc1f87e3f0566daef895ddccf21dff9eb70fbea17ec7d60ba7fdceb35c1b5c
36cfccc84b21d9bb8b3eb93589870aea0b146fd9ba649b785d44bb8dafd82656
758769a19ce049454101441e8d9e29b02c13a62146a43fa7b5692cff09ddf302
6530b7c8d9c8a48d16c94670cc9755f09b0d09efa92d65fbd1f9c7ebadce6630
c805579d25000e5270305c926dee6fcc108efede9195c2bb442a6662ddaca995
9e77a7733be97f17a64c949ef061c9fe5b23ebf3b8a171cad8f4f094ecf62fc8
730e9e0bd0a41438d7d7af227f1441b4f9d8a54988e0add3a2e0fbd7312cc163
http[:]//91.92.242[.]236/files-129312398/files/file_03e1dd22b8ec149f.exe
http[:]//91.92.241[.]243/files/file_391c1e83ac309020.exe
http[:]//85.239.147[.]6/files/Leetootoo/random.exe
http[:]//85.239.147[.]6/files/5851730241/IQEr4wy.exe
http[:]//158.94.208[.]7/files/8705834433/8njNDcy.exe
http[:]//158.94.211[.]222/files/1660459253/W3Trdgs.exe
http[:]//158.94.211[.]222/files/bur/fast.exe
aimemtools[.]cfd
softwareguard[.]cfd
zkevopenanu[.]cfd
dev-tools[.]cfd
sys-tools[.]cfd
aewaterdelivery[.]com
secupd[.]cfd
memaiagent[.]cfd
c4831ec2b68c576199245eb877e83f9b5e83dd3f
c4831ec2b68c576199245eb877e83f9b5e83dd3f
1c24da264bce471366156b4721bacb83201ba759
7c0f669cd06e5ba8fdcdba107b9519fe73519368
Observed July 2026
Packed
0843ddfbe1908c5151495295ff7d1007b3c8bca287a766c437cea6b0e3f72f4d
e96c774b2c8425ab237b0fb36f57a7d8cc7e782b6d4e9a99434f3d21c93d5128
1019d8a20bd7732b2c2747b30646a5d10725fd5ee532b5e858dab27ba150db1e
06f6a0dc417bf0c8d1fa54754f53d37d190a3b9bf66658e00a630ae0bb56dfab
eecf2b15c3656275f7f4d4e1e4287fee795cb857790ca7eca107efa9cd6fad30
2ab248b392653566fe4fb34e2ced50acd8e91941010f38e2a85c792968261f20
69d4b349416a93227b332b50a0d6aa38ec522d528f31f4400f248b247fd607e3
f698f7919b026700cc2a2a9166258b8770ab9412122207f7b955fb97d249b8b9
41b3e4f80aa2deeaf56c5181cd3fc1b2ee545d053d29934408bb17ddd7ea2096
Unpacked
d7979fb0377c30a5361cd3f2f934c1e058a5c86031792dc66eeb24d6d7569661
4332227474b0d7db91a1e156ac3afa58ea4973ff00cb455dfd073fa1ec6dabcd
69a11394f6ee9d2af144f57d47632806f0760d5f1bdb69310a000b436ee3b5bc
9d02336c331bd335887c04ee466be41bc1a2a7e9069a9e9aaca2765484af0f14
b3708f27ddaebb5f2f256416e5082de39dd48d2a9b2bf0e9076794c3c4ca8506
aa1f23f90cd08417a86783f9c0f80c31cc621e852091f2e7ad724b89f74f11c8
510ce9e01292433f1e1163abb6a8896e3ebb2269a0489fa91a1dec7d54fec5c9
21c11f37cbf8365d26d243515cd23e822ecfa1d25f3262b62ffb1085efd09d9c
242871749873401e97d2651c5bc1c874ae9a3832a1c14b48630390dff0acafc0
9d93afbd9c5718fe14d9f24a080e8debc6b83f6596babe0aad1b3a9cb5013d01
0fac8922b1afc82d02b7a2d059ec6964a0b29196166b1377d165c08e134400db
c45357593df7614af68592c0f1ef578f824dc6c9d82f7a6198b21be7c06a57d6
900b639b26e321b308ecff93998ee33637bde2a9e198b42208ab70ff9dabe35e
e37280893d138dcc18a14ae4f5e4a13d71419da82ba978d7dcad510af95e86aa
2abb2d9250e78af3b0636a83f6031a14512d7d891e34a043cafc771f2ac3ea12
167873a847a2b996bd3b44b38c819768274efda6daf2978532c7b6b4f1a0acb1
127bfec23f77b6c9f2addd7f1fe8016b41078c8dbdda34737f7cb6b5563ec22b
4a3cf2cd75d78359f4ee1bc64703864781ffd8b93145c58a82078342b8097cef
641bcdaec2580058bfcbf8415ae123c7d9907c688cb107df79e20024e3bc23e2
ecde41aae4e4477a62781afdaa25c3020af8ff03008cc75e6fa0d140428abb63
252ad5844e88d5e3da533f8d913442cdc72d018ed29594a994e19a403026aa0d
377e1b540fd76b28638231ca69f955130768ea9de045e6af18b6e5b88e59211d
4c35c4ca7a9c5170587e4e8f0100f3730082e2a872e74129e38f26d3107e7e0c
8049545b6d7e2ae529a6c754c555164a79b4ebe90da7c56155c9a4282c01304d
e2c92e4a8d22fc18a4e7510fc7ea4a207be80c5028bdc25f2aa06f7aa21627db
a683c423efa53f048b26c3b1c530e2598d7b55833fbe3b198cd5f13a9986fb42
aaf61581328f2df00b47971c2b3882122ab7e52416dc4ac2a9637ea8255810f7
3fa65bbadec7e0d448b4d167ac48399f1f9a0966d5574b25876169171a204aba
bce365972cd411ba22eb09d29792d6bb52dc485be9552a45200502e168d733b5
47a7a38d8e7d729aa0d9312fae2ebd13b7c11a5ae91474a883b7ceb56298f395
86e69bc51a02e619fcae64815445b5d8232d38361d3b055677687621e9b29c7a
dd412434f9fb3d06b009c6e793938e88ab7edf71bf3180753edbcc5f1702f18e
e6a771b99ea4fa87af203a786608d3f7396d1698f43242905a66e6f9539df60e
5ce36e61c71aa43b274142d8be1cb6e38d4ed52336d7b76d06a761534c0da8c4
c42849a90763133a57b4e543a4af231837e54835d3ba9a5cd9130b9d66ea3bae
gw.portallbridge[.]cc
login.metricsdashboard[.]cc
static.quorashift[.]cc
data.nomadhive[.]cc
auth.automationportal[.]cc
wss.vectorplatform[.]cc
edge.kernelmonitor[.]cc
stream.pawpalace[.]cc
res.explicittweak[.]cc
Observed August 2026
28d1f5d695ed65461b36f032f057a2d48b97ea68f149c73ea3401bf9ec0576cb
450216a711f8b3371a2936923201f204fa1c686a2b831dac4a1c0094c105a5fd
000b7533d53d0feed7cd995043a4298fe2b8c5767c1ffff7710f446c682928cb
2f029858b8ecca8fb6c156eb2d046a2463e8b67d356c1003e5567339681a71be
48b82c79a90ed401449260948b269d0909bbdb53847678dfbba09c368016bd7e
608057bea6ee1cc68c1f1bdcbe702a3558270d8f19cc329b8b34bcd133984da8
6f737981ac722be8ae1c05a295667d050abe1b45dd946e1dbf4c46467c517c5f
55fd126063af89eb1c5639a56dcf365f2e817813a45758b3f12a18f12d5561d1
47d5a5ef1afe3d1b8dbfde026a80d97ed0e012c144fa3940bb39758de75ca842
67cd5f1b19d33786a9f73b630357cce0d90d6771590ccb965fb331ffc6d4fb94
9935b9d36e8b6ac544a9a990bcccda8eb346596fbbcb5259bc929835b737c4d2
7e1e424f3c184c3c037235494158be38a9e7b15e0bd4a97c7f854ab03a1f09ed
84b8ec2f3b29a10f88d21fc7617cdfecac1c2c76303086b41471beb5f563f65c
99830a24d6aed654adff341b2c6ad2ba6c971c028dfce1ca455a37d1fbdf4617
ab8cee7ddbeb8d937f8a6855c52cee704bb6f4a10934fcaf17544a8c31cced39
b7c682fc6e8ea93f44c2c86fcd06e664971f42e8290a534c65a32a92d9b53a14
b40cb47ab1775a4be4ec9b997b58bedfeb2076079df0804dc80982c0309fa9a2
c1e0d2c9e04fcdb10ff2d4565758ceda1331fc80def548742a79b60be81da9b9
d3b08fd3ce1ca451b1dffd00c657b6ac1ad8ad769171faa1ba9688b572283d32
cd7c5860e0e6bdbc49ae5f07d85989469a41a108dede6f6086541d276ccc155f
e99d9294331c15c7ee0f4a03f8b95eda42fa065ec7d008bc326f9d8db562c118
de0d703c69ec8421a5351dc02735179aee12e8257b5816108feda8716b695b49
dbd1aae6e2a47af68e987dbfcc91c564d17c532e892938983eac8f891dec81b9
f68ba32766e087f5a6855fa7da9feea2968280a019aec31d7d173adcd4b848ca
f3ef2636d9b60715c2ea7c032cfd20492b7701bfa72ed3652b2bc540760988a0
fc8a7102ed41830084bcd7c4176a93366ad3c9ce0662cb006f15f01f763cb260
28d1f5d695ed65461b36f032f057a2d48b97ea68f149c73ea3401bf9ec0576cb
450216a711f8b3371a2936923201f204fa1c686a2b831dac4a1c0094c105a5fd
000b7533d53d0feed7cd995043a4298fe2b8c5767c1ffff7710f446c682928cb
2f029858b8ecca8fb6c156eb2d046a2463e8b67d356c1003e5567339681a71be
48b82c79a90ed401449260948b269d0909bbdb53847678dfbba09c368016bd7e
608057bea6ee1cc68c1f1bdcbe702a3558270d8f19cc329b8b34bcd133984da8
6f737981ac722be8ae1c05a295667d050abe1b45dd946e1dbf4c46467c517c5f
55fd126063af89eb1c5639a56dcf365f2e817813a45758b3f12a18f12d5561d1
47d5a5ef1afe3d1b8dbfde026a80d97ed0e012c144fa3940bb39758de75ca842
URLs
hxxp[://]azurhay[.]shop:8539
hxxp[://]carogra[.]biz:4219
hxxp[://]fimmora[.]surf:6504
hxxp[://]freshis[.]biz:7752
hxxp[://]hooiuse[.]click:4938
hxxp[://]myrtler[.]biz:9549
hxxp[://]onesdto[.]shop:2535
hxxp[://]slyfogx[.]shop:5776
hxxp[://]topxgax[.]click:4930
hxxp[://]tzpx[.]courses:4437
hxxp[://]uiccvbk[.]click:8839
hxxp[://]youngel[.]biz:8768
hxxp[://]zelpx[.]garden:9895
Domains
azurhay[.]shop
carogra[.]biz
fimmora[.]surf
freshis[.]biz
hooiuse[.]click
myrtler[.]biz
onesdto[.]shop
slyfogx[.]shop
topxgax[.]click
tzpx[.]courses
uiccvbk[.]click
youngel[.]biz
zelpx[.]garden
SVGs are difficult to detect, can be snuck into content — and can do malicious and legitimate actions. Here's how malicious SVGs work.
One of the most effective attack methods I've analyzed this year runs on legitimate tools and willing users — and AV and EDR is blind to it.