June 2026 Infostealer Campaign Trends: Remus, ACRStealer, LummaC2, Vidar Distributed via SEO Poisoning and DLL Sideloading

June 2026 Infostealer Campaign Trends (TL-2026-1353), also tracked as June 2026 Infostealer Trend Wave, is a medium-severity malware campaign, first published 2026-07-15. It has no confirmed attribution, affects Multiple Windows desktop endpoints, maps to 29 MITRE ATT&CK techniques (T1005, T1027, T1036.001), and is covered by 9 detection rules and 38 indicators of compromise.

Key facts for TL-2026-1353

Threat ID
TL-2026-1353
Also known as
June 2026 Infostealer Trend Wave, EtherHiding Infostealer Campaigns
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
individual consumers, gaming, cryptocurrency, technology, financial services
Target regions
Global, south korea, united states of america, germany, mongolia, australia, European Union
Detection rules
9
Indicators of compromise
38

Malware and tooling in June 2026 Infostealer Campaign Trends

Malware and tooling: ACR Stealer, LummaC2, Remus, Vidar, xmrig, Factory-v3, HijackLoader

ASEC's June 2026 infostealer trend report identifies Remus, ACRStealer, LummaC2, and Vidar as the dominant infostealer variants in circulation, distributed via SEO-poisoned search results and file-sharing services (Mediafire, Mega). Samples abuse DLL sideloading (python37.dll, LcMgr.dll, python315.dll), spoof Microsoft Corporation certificates, and macOS variants resolve C2 addresses via Polygon blockchain smart contracts (EtherHiding).

How June 2026 Infostealer Campaign Trends works

AhnLab's ASEC published its June 2026 infostealer trend report identifying Remus, ACRStealer, LummaC2, and Vidar as the four dominant credential-stealing malware families observed in circulation that month. Distribution overwhelmingly relied on SEO poisoning of search results for cracked software and keygens, driving victims to file-sharing services such as Mediafire and Mega that host trojanized installers. 84.5% of collected samples were straightforward EXE droppers, while roughly 15.5% relied on DLL sideloading using hijacked DLL names (python37.dll, LcMgr.dll, python315.dll), and Microsoft Corporation was the most frequently spoofed code-signing identity across samples.

Remus is a 64-bit Malware-as-a-Service infostealer forked directly from Lumma Stealer's source code following the doxxing of Lumma's core developers between August and October 2025. It shares Lumma's anti-VM CPUID hypervisor checks (KVM, QEMU/TCG, VMware, VirtualBox, Xen) and sandbox-DLL detection via CRC32-hashed PEB module walks, but replaces Lumma's ROT-15 dead-drop resolvers with 'EtherHiding' — resolving live C2 domains via eth_call JSON-RPC requests against hardcoded Ethereum/Polygon smart contracts, an approach researchers describe as effectively immune to conventional takedown. Remus steals browser passwords, cookies, session tokens (enabling MFA bypass via active session theft), cryptocurrency wallets, Discord tokens, and clipboard contents, and injects into browser processes to defeat Chrome's App-Bound Encryption, falling back to SYSTEM token impersonation on injection failure.

ACRStealer is distributed via HijackLoader-based installers hosted on Mediafire, AWS S3, and Mega, often via the pivigames[.]blog redirector, and impersonates Ren'Py game packages. It performs syscall-level EDR evasion (NTCalls/WoW64 abuse, manual NTDLL Export Address Table parsing via modified djb2 hashing), bypasses Chrome App-Bound Encryption for versions prior to 127, and specifically targets Steam credential files (loginuser.vdf, local.vdf) alongside Discord and Twitch session data.

LummaC2, a long-running MaaS stealer, continues browser/crypto-wallet theft via fake-CAPTCHA (ClickFix) lures that trick victims into pasting and executing a hidden PowerShell command, and maintains tiered C2 infrastructure (hardcoded .shop-TLD tier-1 domains behind Cloudflare, with Steam-profile and Telegram-channel fallback resolvers) despite a May 2025 Microsoft/Europol-led takedown.

Vidar Stealer campaigns observed through April 2026 pair Go-based Factory-v3 loaders — all discovered samples share a Go 1.25.9 build fingerprint — with forged Authenticode signatures impersonating JustWatch GmbH and BleacherReport, DLL side-loading of Windows Defender's MpClient.dll export surface, and co-bundled XMRig cryptomining, POSTing stolen data to bare-IP C2 panels over HTTPS.

A parallel and increasingly prominent macOS-targeted vector, ClickFix, compromises WordPress sites to serve fake CAPTCHA/system-utility prompts that trick victims into pasting Terminal/Bash commands, delivering infostealers (Macsync, Shub Stealer, AMOS) and establishing LaunchAgent persistence. Since March 2026, this campaign (tracked by Unit 42 as an 'Aeternum'-style operation) has rotated C2 domains roughly every 22 hours via a single Polygon smart contract's getURL() function queried over public eth_call RPC endpoints, blending malicious lookups into legitimate Web3 traffic across 130+ compromised sites. Adjacent June activity also included AgentTesla delivered via Japanese materials-company impersonation and DarkCloud via Indian electronics-manufacturer impersonation, both using compressed email attachments with SMTP-based exfiltration.

MITRE ATT&CK techniques used in TL-2026-1353

Collection

T1005 Data from Local System; T1115 Clipboard Data; T1123 Audio Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1036.001 Invalid Code Signature; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1049 System Network Connections Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery

Credential Access

T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1187 Forced Authentication; T1555 Credentials from Password Stores

collection

T1056.004 Credential API Hooking

Execution

T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1665 Hide Infrastructure

Privilege Escalation

T1134.003 Make and Impersonate Token

Persistence

T1547.001 Registry Run Keys / Startup Folder

stealth

T1574.001 DLL

Resource Development

T1584 Compromise Infrastructure; T1608.006 SEO Poisoning

Affected products and versions in June 2026 Infostealer Campaign Trends

  • Multiple — Windows desktop endpoints
    Vulnerable versions: All supported Windows versions running unpatched/unmonitored endpoints
  • Apple — macOS
    Vulnerable versions: macOS systems targeted via ClickFix Terminal/Bash lures
  • Google — Chrome (App-Bound Encryption)
    Vulnerable versions: Chrome versions prior to 127 (ACRStealer ABE bypass); browser-memory injection bypass in later versions via Remus

Remediation for June 2026 Infostealer Campaign Trends

Immediate actions

  • Block identified C2 IPs and domains (136.243.203.109, 136.243.203.111, 138.199.246.13, 116.203.243.208, 157.180.40.106, 178.16.52.101, apdhlhs3.xyz, bduwih8.pro, johncon.my, baxe.pics, buccstanor.pics, forestoaker.com, playtogga.com, pivigames.blog, authorization-cdn-press-enter.info, pool.supportxmr.com) at perimeter and DNS layers
  • Block or heavily restrict downloads of executables from Mediafire, Mega, and similar consumer file-sharing/cloud-storage domains on corporate endpoints
  • Deploy application allow-listing / Attack Surface Reduction rules to prevent execution of DLLs sideloaded under unexpected process trees (python37.dll, LcMgr.dll, python315.dll, MpClient.dll)
  • Alert on outbound eth_call JSON-RPC traffic to public Polygon/Ethereum RPC endpoints from non-Web3 endpoints, and on repeated PowerShell/Terminal 'paste-and-run' prompts (ClickFix pattern)
  • Educate users against running clipboard-pasted commands from CAPTCHA/verification prompts on any OS

Workarounds

  • Restrict or monitor use of cracked/pirated software and keygen downloads on managed endpoints via web-filtering categories for piracy/warez sites
  • Disable or tightly control macOS Terminal/Bash execution triggered from browser-copied clipboard content where feasible via endpoint policy

Longer-term hardening

  • Deploy EDR with behavioral detection for process injection into browser processes, PEB-walk sandbox-detection patterns, and syscall-level API hooking bypass
  • Enforce Chrome/Edge App-Bound Encryption and keep browsers on versions that mitigate known ABE-bypass techniques
  • Implement network egress filtering / DNS-based threat intelligence feeds capable of ingesting rapidly rotating blockchain-resolved C2 infrastructure
  • Harden WordPress installations (patching, plugin hygiene, WAF) to reduce the compromised-site pool used for ClickFix delivery
  • Deploy code-signing certificate reputation controls to flag binaries signed with certificates recently associated with impersonation (JustWatch GmbH, BleacherReport, Microsoft Corporation lookalikes)

Timeline of June 2026 Infostealer Campaign Trends

  • The Hacker News reports on the 'Aeternum' C2 botnet storing encrypted commands on the Polygon blockchain to evade takedown, an early public documentation of blockchain-based C2 resolution in infostealer/botnet campaigns.
  • ASEC's February 2026 infostealer trend report identifies ACRStealer, LummaC2, and Vidar as the primary distributed infostealer families for the month.
  • Flare researchers begin an underground-forum tracking window (through 2026-05-08) capturing 128 posts documenting the REMUS operation's commercial development and feature rollout.
  • G DATA publishes 'Endgame Harvesting,' detailing ACRStealer's syscall-evasion techniques, HijackLoader-based distribution, and C2 infrastructure.
  • Unit 42 observes a financially motivated campaign delivering Vidar Stealer alongside the XMRig cryptocurrency miner, with a notable activity spike in mid-to-late April 2026 targeting the U.S. and EU.
  • Microsoft publishes research on a ClickFix campaign using fake macOS utility lures to deliver infostealers including Macsync, Shub Stealer, and AMOS.
  • Flare's underground-forum tracking window on the REMUS operation concludes, having documented rapid MaaS feature evolution since February.
  • Unit 42 publishes timely threat intelligence on a ClickFix campaign delivering a macOS infostealer via DMG files.
  • ASEC publishes its June 2026 Infostealer Trend Report, naming Remus, ACRStealer, LummaC2, and Vidar as the month's dominant infostealer families and detailing SEO-poisoning distribution, DLL sideloading, certificate spoofing, and Polygon-based C2 resolution.

Sources cited for June 2026 Infostealer Campaign Trends

Threats related to June 2026 Infostealer Campaign Trends

Detection coverage for TL-2026-1353

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1353 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1353

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats