# Infostealers Weekly Report 2026-10-12 to 2026-10-19: Acreed, Warden Stealer, Remus and Vidar Credential Theft Activity

> Weekly infostealer telemetry for 2026-10-12 to 2026-10-19 reports 34,921 compromised machines, 11,326 compromised users and 387,782 compromised domains. Generic Stealer (25,169 machines), Acreed (6,705), Warden Stealer (2,150), Remus (896) and Vidar (1) were the families observed, with India the most affected country (6,345 machines).

- **Published:** 2026-10-19T09:22:02Z
- **Last reviewed:** 2026-10-19T09:22:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3869
- **ID:** TL-2026-3869
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Infostealers.com published its weekly infostealer telemetry report on 2026-10-19 covering 2026-10-12 to 2026-10-19. It reports 34,921 compromised machines, 7,975 compromised employees, 11,326 compromised users, 15,620 compromised Android devices and 387,782 compromised domains across 171 countries. India was the most affected country (6,345 machines), followed by Brazil (695), Pakistan (670), Bangladesh (660), the Philippines (564), Indonesia (509), Vietnam (490) and the USA (438).

The malware landscape for the week was Generic Stealer (25,169 machines), Acreed (6,705), Warden Stealer (2,150), Remus (896) and Vidar (1). Windows Defender was the most common antivirus on infected hosts (11,267 machines); 1,064 infected machines had no antivirus. The source lists no CVEs, no IOCs (hashes, domains, IPs) and no actor attribution. This record is therefore a weekly telemetry aggregate, and severity MEDIUM is an analyst judgement.

Credential logs most often contained the application keywords 'auth' (145,630 hits), 'sso' (37,498), 'zoom' (9,738), 'github' (7,702), 'webmail' (3,898), 'adfs' (3,196), 'oracle', 'sap', 'zendesk', 'cpanel', 'vpn', 'okta' (666), 'salesforce' (1,153) and 'owa' (1,067). Top compromised domains were google.com (24,784 users), facebook.com (17,762), live.com (15,364), instagram.com (13,495) and discord.com (8,898); microsoftonline.com (6,623), openai.com (5,134) and github.com (4,151) also appear. Fortune 500 employee exposure included Salesforce (21), Microsoft (18), IBM (9), Publix (9), Rockwell Automation (7), Google (6), CBRE (6) and Oracle (6). Top corporate domains were icicibank.com (285 employees) and hostinger.com (275). Gmail accounted for 1,225,748 users in email-provider exposure.

Family context from secondary sources: Acreed emerged on 2025-02-10, rose after the May 2025 Lumma Stealer takedown, produces minimal logs (browser passwords, cookies, autofill), is delivered via phishing, ClickFix fake CAPTCHAs, malvertising and malicious tutorials, and has been reported to use the BNB Smart Chain testnet and the Steam platform as dead-drop resolvers for C2 domains (Bitsight, Intrinsec, Webz.io); Bitsight reports 61% of Acreed credentials are SaaS and 77% include SSO credentials. Warden Stealer (formerly CallbackBeaver) is a Rust-based MaaS stealer for Windows 8-11, first advertised 2026-07-24 per KrakenLabs via GridinSoft; it claims 330+ applications, 200+ wallet extensions, an App-Bound Encryption bypass, a 10-network crypto clipper and a built-in loader (injection, DLL sideloading, standalone), targets Claude, Codex, Grok and Cursor local data/tokens, and is sold at $450/month (personal) and $1,500/month (enterprise v1.9). GridinSoft states these are seller claims with no public sample or verified IOC set. Remus is a 64-bit Lumma Stealer successor (Flare analysis of 128 underground posts, 2026-02-12 to 2026-05-08) with session/cookie theft, Discord token theft, SOCKS5 proxy support, IndexedDB collection for 1Password and LastPass extensions, Bitwarden targeting, restore-token functionality and anti-VM toggles; secondary reporting also describes EtherHiding via Ethereum smart contracts for C2 resolution. Vidar (1 machine this week) is a long-running MaaS fork of Arkei, delivered via spam, cracked software and keygens.

Defensive relevance: stolen browser sessions and SSO/ADFS/Okta/VPN/OWA credentials enable valid-account and session-cookie replay without MFA. Defenders should hunt for ClickFix-style paste-and-run execution, unsigned DLL sideloading and process injection from user-writable paths, anomalous browser credential-store access, and token/session reuse from new geographies, and should revoke sessions and rotate credentials for any infected endpoint.

## MITRE ATT&CK

- T1566 Phishing
- T1204.004 User Execution: Malicious Copy and Paste
- T1204.002 User Execution: Malicious File
- T1055 Process Injection
- T1574.001 DLL
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.005 Credentials from Password Stores: Password Managers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1102.001 Web Service: Dead Drop Resolver
- T1090 Proxy

## Sources

- [Infostealers Weekly Report: 2026-10-12 – 2026-10-19](https://www.infostealers.com/report/infostealers-weekly-report-2026-10-12-2026-10-19/)
- [The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape (Bitsight)](https://www.bitsight.com/blog/the-rise-of-acreed-infostealer)
- [Acreed infostealer (Intrinsec, TLP:CLEAR)](https://www.intrinsec.com/wp-content/uploads/2025/09/TLP-CLEAR-Sept-2025-Acreed-infostealer-EN.pdf)
- [Acreed Infostealer: Everything We Know So Far (Webz.io)](https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/)
- [Acreed Emerges as Dominant Infostealer Threat Following Lumma Takedown (Infosecurity Magazine)](https://infosecurity-magazine.com/news/acreed-dominant-infostealer-lumma)
- [WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (GridinSoft)](https://blog.gridinsoft.com/warden-stealer-malware/)
- [Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens (Daily Security Review)](https://dailysecurityreview.com/?p=44403)
- [Inside the Remus infostealer: session theft, MaaS and rapid evolution (BleepingComputer)](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/amp)
- [Remus Stealer: A New, Not-So-New Infostealer (Flashpoint)](https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/)
- [Remus: Unpacking the 64-bit Evolution of the Lumma Stealer (SOC Prime)](https://socprime.com/active-threats/remus-unpacking-the-64-bit-evolution-of-the-lumma-stealer/)
- [Vidar Stealer Malware Threat Profile (Blackpoint Cyber)](https://blackpointcyber.com/threat-profile/vidar-stealer-malware-apg/)
- [Vidar Stealer Under the Lens: A Deep Dive Analysis (Cyble)](https://cyble.com/blog/vidar-stealer-under-the-lens-a-deep-dive-analysis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3869