Threat reportMalwareTL-2026-5041
Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar
Hudson Rock's weekly infostealer telemetry (from stealer C2 logs) counts 25,609 compromised machines, 5,950 compromised employees and 13,361 compromised Android devices across 151 countries, with 270,372 compromised domains. Generic Stealer (24,799 machines) dominates, followed by Warden Stealer (428), Acreed (374), Remus (7) and Vidar (1).
Key facts for Hudson Rock infostealer report
| Identifiers | TL-2026-5041 |
|---|---|
| Also known as | Hudson Rock Infostealers Weekly Report |
| Severity | MEDIUM |
| First disclosed | |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Windows (endpoints; Windows Defender present on 13,418 infected machines); Google Android (13,361 compromised devices) and Chromium-based browsers |
| Malware | Acreed, CallbackBeaver, Generic Stealer, Lumma Stealer - S1213, Remus, ShadowLoader, Tenzor, Vidar, Warden Stealer |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1027 Obfuscated Files or Information, T1055 Process Injection, T1140 Deobfuscate/Decode Files or Information, T1204.002 User Execution: Malicious File, T1204.004 User Execution: Malicious Copy and Paste, T1497.001 Virtualization/Sandbox Evasion: System Checks, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1552.001 Unsecured Credentials: Credentials In Files, T1555.003 Credentials from Password Stores: Credentials from Web Browsers, T1566 Phishing and 2 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | technology, finance, government administration, consumer, social-media, enterprise-saas |
| Target regions | South Asia, Southeast Asia, North America, 005 - South America |
| Detection rules | 9 (1 shown free) |
| Sources | 12 cited sources |
Detection coverage for Hudson Rock infostealer report
As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5041 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Non-Browser Access To Browser Credential Stores And AI-Agent Token Files - Infostealer Collection
TL-2026-5041: Fires when a process that is not the owning browser or tool reads Chromium/Firefox Login Data, Cookies, Local State, key4.db or AI-assistant and cloud token files (.claude, .codex, .aws, gh). This is the defining behaviour of Warden Stealer (Chromium Application-Bound Encryption bypass, AI-tool token theft), Acreed, Remus and Vidar, and supports session-theft response (invalidate sessions, rotate tokens).
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1555.003, T1539, T1528, T1552.001, T1005
- Data sources: windows_security_4663, sysmon, defender_for_endpoint
- Severity: high
- Confidence: medium
Splunk SPL
index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4663 earliest=-24h
(((ObjectName="*\\User Data\\*" OR ObjectName="*\\Mozilla\\Firefox\\Profiles\\*" OR ObjectName="*\\Opera Software\\*")
(ObjectName="*\\Login Data" OR ObjectName="*\\Cookies" OR ObjectName="*\\Web Data" OR ObjectName="*\\Local State" OR ObjectName="*\\logins.json" OR ObjectName="*\\key4.db" OR ObjectName="*\\cookies.sqlite"))
OR ObjectName="*\\.claude\\.credentials.json" OR ObjectName="*\\.codex\\auth.json" OR ObjectName="*\\.aws\\credentials" OR ObjectName="*\\gh\\hosts.yml")
NOT (ProcessName="*\\chrome.exe" OR ProcessName="*\\msedge.exe" OR ProcessName="*\\firefox.exe" OR ProcessName="*\\brave.exe" OR ProcessName="*\\opera.exe" OR ProcessName="*\\vivaldi.exe" OR ProcessName="*\\elevation_service.exe" OR ProcessName="*\\MsMpEng.exe" OR ProcessName="*\\claude.exe" OR ProcessName="*\\codex.exe" OR ProcessName="*\\cursor.exe" OR ProcessName="*\\Code.exe" OR ProcessName="*\\aws.exe" OR ProcessName="*\\gh.exe")
| stats count dc(ObjectName) as objects_touched values(ObjectName) as objects by host, SubjectUserName, ProcessName
| where objects_touched>=2Microsoft KQL
let AllowedProcs = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe", "elevation_service.exe", "MsMpEng.exe", "claude.exe", "codex.exe", "cursor.exe", "Code.exe", "aws.exe", "gh.exe"]);
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where (ObjectName has_any (@"\User Data\", @"\Mozilla\Firefox\Profiles\", @"\Opera Software\")
and ObjectName matches regex @"(?i)\\(Login Data|Cookies|Web Data|Local State|logins\.json|key4\.db|cookies\.sqlite)$")
or ObjectName matches regex @"(?i)\\(\.claude\\\.credentials\.json|\.codex\\auth\.json|\.aws\\credentials|gh\\hosts\.yml)$"
| extend Proc = tostring(split(ProcessName, "\\")[-1])
| where Proc !in~ (AllowedProcs)
| summarize ObjectCount = dcount(ObjectName), Objects = make_set(ObjectName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SubjectUserName, ProcessName
| where ObjectCount >= 2Sigma
title: Non-Browser Process Access To Browser Credential Stores Or AI-Agent Token Files
id: b4e2d3c5-6c7f-4b80-9dae-1f203b4c5d6e
status: experimental
description: Detects a process other than the owning browser or tool reading Chromium/Firefox credential and cookie stores (Login Data, Cookies, Local State, key4.db) or AI coding assistant and cloud token files, the core infostealer behaviour of Warden Stealer (ABE bypass), Acreed, Remus and Vidar in TL-2026-5041.
references:
- https://www.infostealers.com/report/infostealers-weekly-report-2026-10-26-2026-11-02/
- https://www.bitsight.com/blog/the-rise-of-acreed-infostealer
- https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
- attack.credential-access
- attack.t1555.003
- attack.t1539
- attack.t1528
- attack.t1552.001
- attack.collection
- attack.t1005
logsource:
category: file_access
product: windows
detection:
selection_browser:
TargetFilename|contains:
- '\User Data\'
- '\Mozilla\Firefox\Profiles\'
- '\Opera Software\'
TargetFilename|endswith:
- '\Login Data'
- '\Cookies'
- '\Web Data'
- '\Local State'
- '\logins.json'
- '\key4.db'
- '\cookies.sqlite'
selection_tokens:
TargetFilename|endswith:
- '\.claude\.credentials.json'
- '\.codex\auth.json'
- '\.aws\credentials'
- '\gh\hosts.yml'
filter_main_legit:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\opera.exe'
- '\vivaldi.exe'
- '\elevation_service.exe'
- '\MsMpEng.exe'
- '\claude.exe'
- '\codex.exe'
- '\cursor.exe'
- '\Code.exe'
- '\aws.exe'
- '\gh.exe'
condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
- Backup, EDR or DLP agents scanning browser profiles
- Password-migration tools and browser import wizards
- Developer tooling reading AWS or GitHub credential files
level: high
Known false positives:
- Backup, EDR or DLP agents scanning browser profiles
- Password-migration tools or profile-import wizards
- Developer tools reading AWS or GitHub credential files
Tuning notes: Requires Object Access > File System auditing with SACLs on browser profile directories and token files (Event 4663). Tune the process allow-list to your EDR and backup agents; raise the objects_touched threshold if noisy. Hits from unsigned binaries in user-writable paths should be escalated to session and token revocation.
- Browser Download Of Installer From Stealer Malvertising / ClickFix Infrastructure · unlock with TL Creds
- In-Memory Stealer Injection Into explorer.exe From User-Writable Path (Warden Loader) · unlock with TL Creds
- explorer.exe Outbound HTTPS To Rare Public Host - Injected Stealer Exfiltration (Warden) · unlock with TL Creds
- Fake Installer Lure Execution - MediaGet / CapCut / Trade-Journal MSI (Stealer Malvertising) · unlock with TL Creds
- Unsigned DLL Sideloading From User-Writable Path - Warden Loader / Acreed ShadowLoader · unlock with TL Creds
- DNS Resolution Of Community-Observed Stealer Malvertising And Relay Infrastructure · unlock with TL Creds
- ClickFix Run-Dialog Script Launch With Download Cradle - Infostealer Delivery (Warden / Acreed / Remus / Vidar) · unlock with TL Creds
- Non-Browser Dead-Drop C2 Resolution - Steam Profiles, BNB / Ethereum RPC, Telegram (Acreed / Remus) · unlock with TL Creds
Indicators of compromise for Hudson Rock infostealer report
As of 2026-11-02, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5041.
How Hudson Rock infostealer report works
The Infostealers.com weekly report (Hudson Rock, published 2026-11-02) aggregates data from infostealer command-and-control server logs, recording saved credentials and active sessions at the moment of machine compromise. For 2026-10-26 to 2026-11-02 it reports 25,609 compromised machines, 5,950 compromised employees (identified by corporate email), 6,298 compromised users, 13,361 compromised Android devices and 270,372 compromised domains. Infections span 151 countries; India leads with 5,962 infected machines, followed by Bangladesh (628), the United States (564), Vietnam (513), Brazil (506), Pakistan (452), Philippines (334), Nepal (189), Indonesia (158) and Colombia (142).
By family, unattributed 'Generic Stealer' accounts for 24,799 machines (about 96%), Warden Stealer for 428, Acreed for 374, Remus for 7 and Vidar for 1. Windows Defender was present on 13,418 infected machines (about 52%), so infection occurred despite built-in AV; 1,655 machines showed no AV detected. Most-exposed domains by users are google.com (18,621), facebook.com (13,077), live.com (11,683), instagram.com (10,452) and microsoftonline.com (5,320). Gmail accounts for 843,312 compromised email credentials, hotmail.com for 78,058 and yahoo.com for 22,316. Enterprise-relevant keywords in credential logs include auth (102,275 hits), sso (30,000), zoom (7,274), github (5,583), webmail (2,719), adfs (2,203), oracle (1,898), sap (1,542), ping (1,078) and zendesk (1,041). Among S&P companies, 26 Salesforce, 25 Microsoft, 6 Cognizant, 4 IBM and 4 Rockwell Automation employees were compromised. On Android, Facebook (7,060), Instagram (6,508), Netflix (4,196), Snapchat (2,979) and Spotify (2,938) were the most-exposed apps.
The named families are supported by public research. Warden Stealer is a Rust-based MaaS stealer reported by Gen Threat Labs as appearing on underground forums in August 2026 and as successor to CallbackBeaver; it uses an in-house loader that rebuilds the stealer in memory (injection into explorer.exe, DLL sideloading or standalone modes), uses code morphing and VM checks, bypasses Chromium Application-Bound Encryption, runs a crypto clipper across ten networks, exfiltrates over HTTPS with a custom binary protocol and steals configuration files and tokens of AI coding assistants and agentic tools. Acreed emerged in February 2025 and grew after the May 2025 LummaC2 disruption; public reporting describes a ShadowLoader dropper, Steam-profile and BNB Smart Chain dead-drop resolvers for C2, JSON-based exfiltration and DLL side-loading, with delivery via phishing, ClickFix and malvertising. Remus is a 64-bit MaaS stealer with strong code overlap with Lumma (reportedly via an intermediate 'Tenzor' variant), using EtherHiding, Google OAuth cookie restoration and Telegram log delivery. Vidar is a long-running MaaS stealer (active since November 2018).
The source provides no CVEs, named threat actors, campaigns, IP addresses, domains or file hashes, so none are included; IOCs listed are behavioral and family-level indicators only. Severity is analyst-assigned. Defenders should treat infections as credential and session-token exposure events: invalidate sessions, rotate credentials and secrets (including AI-tool and API tokens), and enforce phishing-resistant MFA and device-bound sessions.
MITRE ATT&CK techniques by tactic:
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL
Execution
T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
Command and Control
Remediation for Hudson Rock infostealer report
Immediate actions
- Treat any host with a confirmed infostealer as fully compromised: isolate it, then revoke all browser sessions and reset passwords for every account saved on it
- Invalidate SSO/OAuth sessions and refresh tokens for affected employees (auth, sso, adfs, ping, github, zoom, webmail logins are the most-exposed keywords)
- Rotate API keys, MCP credentials and tokens for AI coding assistants stored on affected developer workstations
- Query EDR/proxy logs for unsigned processes injecting into explorer.exe and for DLL sideloading from user-writable paths
Workarounds
- Block clipboard-pasted commands via Run dialog/PowerShell where not required to disrupt ClickFix
- Alert on browser credential/cookie store access by non-browser processes
Longer-term hardening
- Enforce phishing-resistant MFA (FIDO2/passkeys) and device-bound or short-lived session tokens to reduce stolen-cookie replay
- Block personal-browser credential saving on managed endpoints and monitor corporate credentials in infostealer-log feeds
- Restrict software installation to remove cracked-software and game-cheat delivery paths; train users against ClickFix copy-paste lures
- Enable tamper protection and behavioral EDR; do not rely on Windows Defender signatures alone (present on 13,418 infected machines)
Affected and fixed versions
Timeline of Hudson Rock infostealer report
- locked-ioc-13 stealer reported as active since November 2018 (day not stated in sources; month-level date) and sold as MaaS.
- locked-ioc-10 infostealer first emerges (February 10th, 2025) on Russian-speaking cybercrime forums.
- LummaC2 infrastructure disrupted (May 2025; day not stated); locked-ioc-10 subsequently fills the market gap.
- Bitsight observes 118,000+ locked-ioc-10 logs on Russian dark web markets in June 2025 (April: 50 logs; May: 864).
- locked-ioc-12 64-bit MaaS stealer, closely related to Lumma, emerges (Flashpoint: March 2026; other reporting says early 2026).
- locked-ioc-6 (Rust MaaS, successor to locked-ioc-7) appears on underground forums in August 2026 (day not stated).
- Start of the Hudson Rock reporting window: 25,609 machines, 5,950 employees and 13,361 Android devices later reported compromised.
- Infostealers.com publishes the weekly report: locked-ioc-4 24,799 machines, Warden 428, locked-ioc-10 374, locked-ioc-12 7, locked-ioc-13 1; 270,372 compromised domains.
Sources cited for Hudson Rock infostealer report
- Infostealers Weekly Report: 2026-10-26 - 2026-11-02 (Hudson Rock / Infostealers.com) infostealers.com · Research · 2026-11-02
- The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape (Bitsight) bitsight.com · Vendor report
- Acreed infostealer (Intrinsec, TLP:CLEAR) intrinsec.com · Research
- Remus Stealer: A New, Not-So-New Infostealer (Flashpoint) flashpoint.io · Vendor report
- Vidar Stealer malware threat profile (Blackpoint Cyber) blackpointcyber.com · Vendor report
- Vidar Stealer and XMRig miner campaign analysis (Unit 42) Unit 42 · Vendor report
- Infostealers now target AI tokens and API keys (SpyCloud) spycloud.com · Vendor report
- WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (GridinSoft) blog.gridinsoft.com · Blog
- Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens (Gen Threat Labs analysis) securityonline.info · News
- New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows cyberpress.org · News
- Acreed: the new infostealer using BNB Smart Chain and Steam profiles for stealthy C2 securityonline.info · News
- Inside the Remus infostealer: session theft MaaS and rapid evolution (BleepingComputer) BleepingComputer · News
Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.
