# June 2026 Infostealer Campaign Trends: Remus, ACRStealer, LummaC2, Vidar Distributed via SEO Poisoning and DLL Sideloading

> ASEC's June 2026 infostealer trend report identifies Remus, ACRStealer, LummaC2, and Vidar as the dominant infostealer variants in circulation, distributed via SEO-poisoned search results and file-sharing services (Mediafire, Mega). Samples abuse DLL sideloading (python37.dll, LcMgr.dll, python315.dll), spoof Microsoft Corporation certificates, and macOS variants resolve C2 addresses via Polygon blockchain smart contracts (EtherHiding).

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1353
- **ID:** TL-2026-1353
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab's ASEC published its June 2026 infostealer trend report identifying Remus, ACRStealer, LummaC2, and Vidar as the four dominant credential-stealing malware families observed in circulation that month. Distribution overwhelmingly relied on SEO poisoning of search results for cracked software and keygens, driving victims to file-sharing services such as Mediafire and Mega that host trojanized installers. 84.5% of collected samples were straightforward EXE droppers, while roughly 15.5% relied on DLL sideloading using hijacked DLL names (python37.dll, LcMgr.dll, python315.dll), and Microsoft Corporation was the most frequently spoofed code-signing identity across samples.

Remus is a 64-bit Malware-as-a-Service infostealer forked directly from Lumma Stealer's source code following the doxxing of Lumma's core developers between August and October 2025. It shares Lumma's anti-VM CPUID hypervisor checks (KVM, QEMU/TCG, VMware, VirtualBox, Xen) and sandbox-DLL detection via CRC32-hashed PEB module walks, but replaces Lumma's ROT-15 dead-drop resolvers with 'EtherHiding' — resolving live C2 domains via eth_call JSON-RPC requests against hardcoded Ethereum/Polygon smart contracts, an approach researchers describe as effectively immune to conventional takedown. Remus steals browser passwords, cookies, session tokens (enabling MFA bypass via active session theft), cryptocurrency wallets, Discord tokens, and clipboard contents, and injects into browser processes to defeat Chrome's App-Bound Encryption, falling back to SYSTEM token impersonation on injection failure.

ACRStealer is distributed via HijackLoader-based installers hosted on Mediafire, AWS S3, and Mega, often via the pivigames[.]blog redirector, and impersonates Ren'Py game packages. It performs syscall-level EDR evasion (NTCalls/WoW64 abuse, manual NTDLL Export Address Table parsing via modified djb2 hashing), bypasses Chrome App-Bound Encryption for versions prior to 127, and specifically targets Steam credential files (loginuser.vdf, local.vdf) alongside Discord and Twitch session data.

LummaC2, a long-running MaaS stealer, continues browser/crypto-wallet theft via fake-CAPTCHA (ClickFix) lures that trick victims into pasting and executing a hidden PowerShell command, and maintains tiered C2 infrastructure (hardcoded .shop-TLD tier-1 domains behind Cloudflare, with Steam-profile and Telegram-channel fallback resolvers) despite a May 2025 Microsoft/Europol-led takedown.

Vidar Stealer campaigns observed through April 2026 pair Go-based Factory-v3 loaders — all discovered samples share a Go 1.25.9 build fingerprint — with forged Authenticode signatures impersonating JustWatch GmbH and BleacherReport, DLL side-loading of Windows Defender's MpClient.dll export surface, and co-bundled XMRig cryptomining, POSTing stolen data to bare-IP C2 panels over HTTPS.

A parallel and increasingly prominent macOS-targeted vector, ClickFix, compromises WordPress sites to serve fake CAPTCHA/system-utility prompts that trick victims into pasting Terminal/Bash commands, delivering infostealers (Macsync, Shub Stealer, AMOS) and establishing LaunchAgent persistence. Since March 2026, this campaign (tracked by Unit 42 as an 'Aeternum'-style operation) has rotated C2 domains roughly every 22 hours via a single Polygon smart contract's getURL() function queried over public eth_call RPC endpoints, blending malicious lookups into legitimate Web3 traffic across 130+ compromised sites. Adjacent June activity also included AgentTesla delivered via Japanese materials-company impersonation and DarkCloud via Indian electronics-manufacturer impersonation, both using compressed email attachments with SMTP-based exfiltration.

## MITRE ATT&CK

- T1608.006 SEO Poisoning
- T1584 Compromise Infrastructure
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1134.003 Make and Impersonate Token
- T1574.001 DLL
- T1036.001 Invalid Code Signature
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1055 Process Injection
- T1555 Credentials from Password Stores
- T1111 Multi-Factor Authentication Interception
- T1187 Forced Authentication
- T1056 Input Capture
- T1056.004 Credential API Hooking
- T1518.001 Security Software Discovery
- T1049 System Network Connections Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1123 Audio Capture
- T1071.001 Web Protocols
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1665 Hide Infrastructure
- T1041 Exfiltration Over C2 Channel

## Sources

- [6월 정보탈취 동향 보고서 (June 2026 Infostealer Trend Report)](https://asec.ahnlab.com/ko/94485/)
- [Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer](https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer)
- [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/)
- [ClickFix: Exploiting Compromised WordPress Sites with a Polygon-Based C2 Infrastructure](https://cyberarmor.tech/blog/clickfix-wordpress-polygon-smart-contract-c2)
- [Endgame Harvesting: Inside ACRStealer's Modern Infrastructure](https://blog.gdatasoftware.com/2026/03/38385-acr-stealer-infrastructure)
- [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [Silent Push maps over 150 new Lumma C2 infostealer IOCs](https://www.silentpush.com/blog/lummac2/)
- [Remus Stealer: A New, Not-So-New Infostealer](https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/)
- [Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown](https://thehackernews.com/2026/02/aeternum-c2-botnet-stores-encrypted.html)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1353