Threat reportMalwareTL-2026-3869
Infostealers Weekly Report 2026-10-12 to 2026-10-19: Acreed, Warden Stealer, Remus and Vidar Credential Theft Activity
Infostealers Weekly Report 2026-10-12 to 2026-10-19 (TL-2026-3869), also tracked as Infostealers Weekly Report 2026-10-12 to 2026-10-19, is a medium-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Windows (consumer and enterprise endpoints), maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1055), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3869
- Threat ID
- TL-2026-3869
- Also known as
- Infostealers Weekly Report 2026-10-12 to 2026-10-19
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, government administration, news - media, telecoms, consumer
- Target regions
- South Asia, 005 - South America, Southeast Asia, North America, Europe, Middle East and North Africa
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Infostealers Weekly Report 2026-10-12 to 2026-10-19
Malware and tooling: Acreed, CallbackBeaver, Generic Stealer, Lumma Stealer - S1213, Remus, Vidar, Warden Stealer, SOCKS5 proxy module (Remus)
How Infostealers Weekly Report 2026-10-12 to 2026-10-19 works
Weekly infostealer telemetry for 2026-10-12 to 2026-10-19 reports 34,921 compromised machines, 11,326 compromised users and 387,782 compromised domains. Generic Stealer (25,169 machines), Acreed (6,705), Warden Stealer (2,150), Remus (896) and Vidar (1) were the families observed, with India the most affected country (6,345 machines).
Infostealers.com published its weekly infostealer telemetry report on 2026-10-19 covering 2026-10-12 to 2026-10-19. It reports 34,921 compromised machines, 7,975 compromised employees, 11,326 compromised users, 15,620 compromised Android devices and 387,782 compromised domains across 171 countries. India was the most affected country (6,345 machines), followed by Brazil (695), Pakistan (670), Bangladesh (660), the Philippines (564), Indonesia (509), Vietnam (490) and the USA (438).
The malware landscape for the week was Generic Stealer (25,169 machines), Acreed (6,705), Warden Stealer (2,150), Remus (896) and Vidar (1). Windows Defender was the most common antivirus on infected hosts (11,267 machines); 1,064 infected machines had no antivirus. The source lists no CVEs, no IOCs (hashes, domains, IPs) and no actor attribution. This record is therefore a weekly telemetry aggregate, and severity MEDIUM is an analyst judgement.
Credential logs most often contained the application keywords 'auth' (145,630 hits), 'sso' (37,498), 'zoom' (9,738), 'github' (7,702), 'webmail' (3,898), 'adfs' (3,196), 'oracle', 'sap', 'zendesk', 'cpanel', 'vpn', 'okta' (666), 'salesforce' (1,153) and 'owa' (1,067). Top compromised domains were google.com (24,784 users), facebook.com (17,762), live.com (15,364), instagram.com (13,495) and discord.com (8,898); microsoftonline.com (6,623), openai.com (5,134) and github.com (4,151) also appear. Fortune 500 employee exposure included Salesforce (21), Microsoft (18), IBM (9), Publix (9), Rockwell Automation (7), Google (6), CBRE (6) and Oracle (6). Top corporate domains were icicibank.com (285 employees) and hostinger.com (275). Gmail accounted for 1,225,748 users in email-provider exposure.
Family context from secondary sources: Acreed emerged on 2025-02-10, rose after the May 2025 Lumma Stealer takedown, produces minimal logs (browser passwords, cookies, autofill), is delivered via phishing, ClickFix fake CAPTCHAs, malvertising and malicious tutorials, and has been reported to use the BNB Smart Chain testnet and the Steam platform as dead-drop resolvers for C2 domains (Bitsight, Intrinsec, Webz.io); Bitsight reports 61% of Acreed credentials are SaaS and 77% include SSO credentials. Warden Stealer (formerly CallbackBeaver) is a Rust-based MaaS stealer for Windows 8-11, first advertised 2026-07-24 per KrakenLabs via GridinSoft; it claims 330+ applications, 200+ wallet extensions, an App-Bound Encryption bypass, a 10-network crypto clipper and a built-in loader (injection, DLL sideloading, standalone), targets Claude, Codex, Grok and Cursor local data/tokens, and is sold at $450/month (personal) and $1,500/month (enterprise v1.9). GridinSoft states these are seller claims with no public sample or verified IOC set. Remus is a 64-bit Lumma Stealer successor (Flare analysis of 128 underground posts, 2026-02-12 to 2026-05-08) with session/cookie theft, Discord token theft, SOCKS5 proxy support, IndexedDB collection for 1Password and LastPass extensions, Bitwarden targeting, restore-token functionality and anti-VM toggles; secondary reporting also describes EtherHiding via Ethereum smart contracts for C2 resolution. Vidar (1 machine this week) is a long-running MaaS fork of Arkei, delivered via spam, cracked software and keygens.
Defensive relevance: stolen browser sessions and SSO/ADFS/Okta/VPN/OWA credentials enable valid-account and session-cookie replay without MFA. Defenders should hunt for ClickFix-style paste-and-run execution, unsigned DLL sideloading and process injection from user-writable paths, anomalous browser credential-store access, and token/session reuse from new geographies, and should revoke sessions and rotate credentials for any infected endpoint.
MITRE ATT&CK techniques used in TL-2026-3869
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL
Command and Control
T1090 Proxy; T1102.001 Web Service: Dead Drop Resolver
Execution
T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1555.005 Credentials from Password Stores: Password Managers
Initial Access
Affected products and versions in Infostealers Weekly Report 2026-10-12 to 2026-10-19
- Microsoft — Windows (consumer and enterprise endpoints)
Vulnerable versions: Windows 8 through Windows 11 (Warden Stealer) - Google — Chromium-based browsers and Android devices (saved credentials, cookies and app caches)
Vulnerable versions: Not version-specific - Mozilla — Gecko-based browsers (Firefox credential stores)
Vulnerable versions: Not version-specific
Remediation for Infostealers Weekly Report 2026-10-12 to 2026-10-19
Immediate actions
- Isolate infected endpoints and revoke all active browser sessions and OAuth/SSO tokens for affected users
- Force password resets and re-enroll MFA for accounts whose credentials were saved in browsers on infected hosts
- Monitor corporate SSO, ADFS, Okta, VPN and webmail logins for impossible travel and session-cookie replay
- Check employee exposure of corporate domains against infostealer-log monitoring services
Workarounds
- Block execution of unsigned binaries from user-writable and temp paths
- Limit local admin rights and block cracked-software and game-cheat downloads
Longer-term hardening
- Disable browser password managers and saved payment data on corporate endpoints
- Enforce phishing-resistant MFA and device-bound session tokens
- Restrict clipboard-to-Run/PowerShell execution (ClickFix) via user training and application control
- Deploy EDR with behavioral detection for process injection and DLL sideloading
- Restrict developer workstation storage of AI coding-agent tokens and rotate them after exposure
Timeline of Infostealers Weekly Report 2026-10-12 to 2026-10-19
- Acreed infostealer first emerges (per Webz.io/Bitsight reporting) and later rises as a leading stealer.
- Law-enforcement operation seizes Lumma Stealer (LummaC2) infrastructure in May 2025; Acreed and Lumma-derived families gain share afterwards.
- Bitsight publishes analysis of Acreed: delivery via phishing, ClickFix, malvertising and malicious tutorials; 118,000+ logs uploaded to Russian markets by June 2025.
- Start of the Flare-analysed window (128 underground posts through 2026-05-08) of the Remus stealer, a Lumma Stealer successor.
- Remus operation reaches a stabilization phase after session/authentication-focused development in April 2026.
- Warden Stealer advertised by its seller (per KrakenLabs via GridinSoft); first builds reportedly from May 2026 and forum sales from August 2026.
- Public analysis reports Warden Stealer (formerly CallbackBeaver) as a Rust-based MaaS stealer targeting AI coding-agent tokens; start of the weekly telemetry window.
- Infostealers.com publishes the 2026-10-12 to 2026-10-19 report: 34,921 compromised machines, 11,326 users and 387,782 domains.
Sources cited for Infostealers Weekly Report 2026-10-12 to 2026-10-19
- Infostealers Weekly Report: 2026-10-12 – 2026-10-19
- The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape (Bitsight)
- Acreed infostealer (Intrinsec, TLP:CLEAR)
- Acreed Infostealer: Everything We Know So Far (Webz.io)
- Acreed Emerges as Dominant Infostealer Threat Following Lumma Takedown (Infosecurity Magazine)
- WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (GridinSoft)
- Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens (Daily Security Review)
- Inside the Remus infostealer: session theft, MaaS and rapid evolution (BleepingComputer)
- Remus Stealer: A New, Not-So-New Infostealer (Flashpoint)
- Remus: Unpacking the 64-bit Evolution of the Lumma Stealer (SOC Prime)
- Vidar Stealer Malware Threat Profile (Blackpoint Cyber)
- Vidar Stealer Under the Lens: A Deep Dive Analysis (Cyble)
Detection coverage for TL-2026-3869
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3869 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.