Threat reportMalwareTL-2026-4026
New Rust-Based Infostealer Distributed via Cracked Software Evades Analysis and Sandboxes (AhnLab ASEC)
New Rust-Based Infostealer Distributed via Cracked Software (TL-2026-4026) is a medium-severity malware campaign, first published 2026-10-21. It has no confirmed attribution, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 3 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 3Indicators of compromise
Key facts for TL-2026-4026
- Threat ID
- TL-2026-4026
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 3
Malware and tooling in New Rust-Based Infostealer Distributed via Cracked Software
Malware and tooling: Rakhni, Rust-based infostealer (unnamed by ASEC), AutoIt
How New Rust-Based Infostealer Distributed via Cracked Software works
AhnLab ASEC reports a new, unnamed Rust-based infostealer distributed disguised as illegal/cracked software. It uses anti-disassembly, CPU-cache-based VM/sandbox detection and encrypted strings, runs via AutoIt, Explorer process injection or standalone, steals credentials, certificates, SSH keys and documents from many application classes, and can download additional malware.
AhnLab's ASEC team describes a new type of infostealer written in Rust and distributed disguised as illegal (cracked) software. ASEC first detected it in mid-August 2026, when it was spread on a small scale and executed through AutoIt, a Windows automation scripting tool. From early September 2026 large-scale distribution began, in forms that run through AutoIt, by injection into the Windows Explorer process, or as a standalone executable. A separate downloader has also been observed delivering the infostealer. ASEC's detection guidance includes watching for users downloading large ZIP files from untrusted sources, decompressing them and running the contained executables.
The malware is built to resist analysis. ASEC documents anti-disassembly via dynamic JMP instructions, and anti-sandbox techniques that use CPU memory cache lookups. Internal strings are encrypted and decrypted only at the moment of use, using modified Base64 index tables that are rotated, with decryption keys that differ per sample; arbitrary data is appended to encrypted strings to obscure their original length. When a VM or sandbox is detected the sample displays "I love stealing cookies, but not on this machine. Sorry!" and terminates without running its payload (the reason for the report's title: behavior changes when the sample is observed). In the Explorer-injection form, an encrypted DLL is decrypted and injected into explorer.exe.
For command and control, ASEC reports that outbound data is XOR-encrypted and then LZNT1-compressed, and inbound data is XOR-decrypted before use, with different XOR keys per sample to evade traffic analysis. The C2 returns configuration data that determines the collection scope. The stealer targets web browsers, instant messengers, email clients, password managers, note-taking applications, VPNs, remote access programs, database management tools, FTP and SSH tools, cloud storage, AI and development tools, cryptocurrency wallets and gaming platforms. It also collects certificates, SSH keys, wallet files, configuration files and documents.
The malware also acts as a dropper: it downloads and executes additional malware from URLs specified by the C2, and ASEC confirmed from configuration data that this feature is enabled. The article names no malware family, threat actor, CVE, hashes, domains or IPs; ASEC withholds IOCs behind its AhnLab TIP subscription. Severity is an analyst estimate, not a source-stated rating.
MITRE ATT&CK techniques used in TL-2026-4026
Collection
T1005 Data from Local System; T1560.003 Archive via Custom Method
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1055.001 Dynamic-link Library Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Execution
T1059.010 AutoHotKey & AutoIT; T1204.002 Malicious File
Command and Control
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Affected products and versions in New Rust-Based Infostealer Distributed via Cracked Software
- Microsoft — Windows
Vulnerable versions: Windows endpoints that execute cracked/illegal software (explorer.exe injection and AutoIt execution observed)
Remediation for New Rust-Based Infostealer Distributed via Cracked Software
Immediate actions
- Hunt for abnormal code injection involving AutoIt.exe or explorer.exe, as recommended by AhnLab ASEC
- Block or remove cracked/illegal software installers from endpoints and prevent their download at the proxy and DNS layers
- Alert on large ZIP archives downloaded from untrusted sources that are extracted and executed
- Rotate credentials, SSH keys, certificates, VPN and remote-access secrets and crypto wallet material on any host where a cracked-software installer was run
- Invalidate browser session cookies and re-authenticate affected accounts
Workarounds
- Apply endpoint AV signatures from AhnLab and other vendors as they become available
- Restrict outbound traffic from user workstations to reduce stealer C2 and second-stage download reach
Longer-term hardening
- Deploy EDR with behavioral detection of process injection into explorer.exe and of AutoIt-launched payloads
- Enforce application allow-listing and restrict execution of AutoIt interpreters where not required
- Prohibit use of unlicensed software and train users on the risks of cracked-software downloads
- Store secrets in managed vaults rather than local configuration files and key files
Timeline of New Rust-Based Infostealer Distributed via Cracked Software
- Early samples execute through AutoIt, a Windows automation scripting tool, per the ASEC article (mid-August 2026, approximate date).
- ASEC first detects the Rust-based infostealer in mid-August 2026 (exact day not stated; date approximated to mid-month), distributed on a small scale as illegal/cracked software.
- A separate downloader delivering the infostealer is observed alongside the wide September distribution (approximate date, per ASEC).
- Variants appear that decrypt an embedded DLL and inject it into explorer.exe (September 2026, approximate date, per ASEC).
- Large-scale distribution begins in early September 2026 (day not stated; date approximated to start of month), with variants that run via AutoIt, Explorer process injection, or standalone.
- AhnLab ASEC publishes its analysis of the infostealer; IOCs are provided only to AhnLab TIP subscribers.
- ASEC reports that C2 configuration data confirmed the dropper feature is enabled: the malware downloads and executes additional payloads from C2-specified URLs.
Sources cited for New Rust-Based Infostealer Distributed via Cracked Software
- Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer (AhnLab ASEC)
- May 2025 Infostealer Trend Report (AhnLab ASEC) - related context on infostealers distributed as cracked software
- August 2025 Infostealer Trend Report (AhnLab ASEC) - related context
- Demystifying Myth Stealer: A Rust-Based Infostealer (Trellix) - related Rust stealer, not the same malware
- Rust-Based Info Stealers Abuse GitHub Codespaces (Trend Micro) - related Rust stealer context, not the same malware
- MITRE ATT&CK T1497.001 Virtualization/Sandbox Evasion: System Checks
Detection coverage for TL-2026-4026
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4026 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.