# Infostealers Weekly Report 2026-10-26 to 2026-11-02: Generic Stealer, Warden Stealer, Acreed, Remus, Vidar

> Hudson Rock's weekly infostealer telemetry (from stealer C2 logs) counts 25,609 compromised machines, 5,950 compromised employees and 13,361 compromised Android devices across 151 countries, with 270,372 compromised domains. Generic Stealer (24,799 machines) dominates, followed by Warden Stealer (428), Acreed (374), Remus (7) and Vidar (1).

- **Published:** 2026-11-02T09:12:53Z
- **Last reviewed:** 2026-11-02T09:12:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5041
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5041.png
- **ID:** TL-2026-5041
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

The Infostealers.com weekly report (Hudson Rock, published 2026-11-02) aggregates data from infostealer command-and-control server logs, recording saved credentials and active sessions at the moment of machine compromise. For 2026-10-26 to 2026-11-02 it reports 25,609 compromised machines, 5,950 compromised employees (identified by corporate email), 6,298 compromised users, 13,361 compromised Android devices and 270,372 compromised domains. Infections span 151 countries; India leads with 5,962 infected machines, followed by Bangladesh (628), the United States (564), Vietnam (513), Brazil (506), Pakistan (452), Philippines (334), Nepal (189), Indonesia (158) and Colombia (142).

By family, unattributed 'Generic Stealer' accounts for 24,799 machines (about 96%), Warden Stealer for 428, Acreed for 374, Remus for 7 and Vidar for 1. Windows Defender was present on 13,418 infected machines (about 52%), so infection occurred despite built-in AV; 1,655 machines showed no AV detected. Most-exposed domains by users are google.com (18,621), facebook.com (13,077), live.com (11,683), instagram.com (10,452) and microsoftonline.com (5,320). Gmail accounts for 843,312 compromised email credentials, hotmail.com for 78,058 and yahoo.com for 22,316. Enterprise-relevant keywords in credential logs include auth (102,275 hits), sso (30,000), zoom (7,274), github (5,583), webmail (2,719), adfs (2,203), oracle (1,898), sap (1,542), ping (1,078) and zendesk (1,041). Among S&P companies, 26 Salesforce, 25 Microsoft, 6 Cognizant, 4 IBM and 4 Rockwell Automation employees were compromised. On Android, Facebook (7,060), Instagram (6,508), Netflix (4,196), Snapchat (2,979) and Spotify (2,938) were the most-exposed apps.

The named families are supported by public research. Warden Stealer is a Rust-based MaaS stealer reported by Gen Threat Labs as appearing on underground forums in August 2026 and as successor to CallbackBeaver; it uses an in-house loader that rebuilds the stealer in memory (injection into explorer.exe, DLL sideloading or standalone modes), uses code morphing and VM checks, bypasses Chromium Application-Bound Encryption, runs a crypto clipper across ten networks, exfiltrates over HTTPS with a custom binary protocol and steals configuration files and tokens of AI coding assistants and agentic tools. Acreed emerged in February 2025 and grew after the May 2025 LummaC2 disruption; public reporting describes a ShadowLoader dropper, Steam-profile and BNB Smart Chain dead-drop resolvers for C2, JSON-based exfiltration and DLL side-loading, with delivery via phishing, ClickFix and malvertising. Remus is a 64-bit MaaS stealer with strong code overlap with Lumma (reportedly via an intermediate 'Tenzor' variant), using EtherHiding, Google OAuth cookie restoration and Telegram log delivery. Vidar is a long-running MaaS stealer (active since November 2018).

The source provides no CVEs, named threat actors, campaigns, IP addresses, domains or file hashes, so none are included; IOCs listed are behavioral and family-level indicators only. Severity is analyst-assigned. Defenders should treat infections as credential and session-token exposure events: invalidate sessions, rotate credentials and secrets (including AI-tool and API tokens), and enforce phishing-resistant MFA and device-bound sessions.

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 User Execution: Malicious File
- T1204.004 User Execution: Malicious Copy and Paste
- T1055 Process Injection
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1568 Dynamic Resolution

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Non-Browser Access To Browser Credential Stores And AI-Agent Token Files - Infostealer Collection** (`TL-2026-5041-SPL-002`)

TL-2026-5041: Fires when a process that is not the owning browser or tool reads Chromium/Firefox Login Data, Cookies, Local State, key4.db or AI-assistant and cloud token files (.claude, .codex, .aws, gh). This is the defining behaviour of Warden Stealer (Chromium Application-Bound Encryption bypass, AI-tool token theft), Acreed, Remus and Vidar, and supports session-theft response (invalidate sessions, rotate tokens).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1528, T1552.001, T1005
- **Data sources:** windows_security_4663, sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=wineventlog sourcetype="XmlWinEventLog:Security" EventCode=4663 earliest=-24h
    (((ObjectName="*\\User Data\\*" OR ObjectName="*\\Mozilla\\Firefox\\Profiles\\*" OR ObjectName="*\\Opera Software\\*")
      (ObjectName="*\\Login Data" OR ObjectName="*\\Cookies" OR ObjectName="*\\Web Data" OR ObjectName="*\\Local State" OR ObjectName="*\\logins.json" OR ObjectName="*\\key4.db" OR ObjectName="*\\cookies.sqlite"))
    OR ObjectName="*\\.claude\\.credentials.json" OR ObjectName="*\\.codex\\auth.json" OR ObjectName="*\\.aws\\credentials" OR ObjectName="*\\gh\\hosts.yml")
    NOT (ProcessName="*\\chrome.exe" OR ProcessName="*\\msedge.exe" OR ProcessName="*\\firefox.exe" OR ProcessName="*\\brave.exe" OR ProcessName="*\\opera.exe" OR ProcessName="*\\vivaldi.exe" OR ProcessName="*\\elevation_service.exe" OR ProcessName="*\\MsMpEng.exe" OR ProcessName="*\\claude.exe" OR ProcessName="*\\codex.exe" OR ProcessName="*\\cursor.exe" OR ProcessName="*\\Code.exe" OR ProcessName="*\\aws.exe" OR ProcessName="*\\gh.exe")
| stats count dc(ObjectName) as objects_touched values(ObjectName) as objects by host, SubjectUserName, ProcessName
| where objects_touched>=2
```

### Microsoft KQL

```kql
let AllowedProcs = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe", "elevation_service.exe", "MsMpEng.exe", "claude.exe", "codex.exe", "cursor.exe", "Code.exe", "aws.exe", "gh.exe"]);
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4663
| where (ObjectName has_any (@"\User Data\", @"\Mozilla\Firefox\Profiles\", @"\Opera Software\")
        and ObjectName matches regex @"(?i)\\(Login Data|Cookies|Web Data|Local State|logins\.json|key4\.db|cookies\.sqlite)$")
    or ObjectName matches regex @"(?i)\\(\.claude\\\.credentials\.json|\.codex\\auth\.json|\.aws\\credentials|gh\\hosts\.yml)$"
| extend Proc = tostring(split(ProcessName, "\\")[-1])
| where Proc !in~ (AllowedProcs)
| summarize ObjectCount = dcount(ObjectName), Objects = make_set(ObjectName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SubjectUserName, ProcessName
| where ObjectCount >= 2
```

### Sigma

```yaml
title: Non-Browser Process Access To Browser Credential Stores Or AI-Agent Token Files
id: b4e2d3c5-6c7f-4b80-9dae-1f203b4c5d6e
status: experimental
description: Detects a process other than the owning browser or tool reading Chromium/Firefox credential and cookie stores (Login Data, Cookies, Local State, key4.db) or AI coding assistant and cloud token files, the core infostealer behaviour of Warden Stealer (ABE bypass), Acreed, Remus and Vidar in TL-2026-5041.
references:
  - https://www.infostealers.com/report/infostealers-weekly-report-2026-10-26-2026-11-02/
  - https://www.bitsight.com/blog/the-rise-of-acreed-infostealer
  - https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.credential-access
  - attack.t1555.003
  - attack.t1539
  - attack.t1528
  - attack.t1552.001
  - attack.collection
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection_browser:
    TargetFilename|contains:
      - '\User Data\'
      - '\Mozilla\Firefox\Profiles\'
      - '\Opera Software\'
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\Local State'
      - '\logins.json'
      - '\key4.db'
      - '\cookies.sqlite'
  selection_tokens:
    TargetFilename|endswith:
      - '\.claude\.credentials.json'
      - '\.codex\auth.json'
      - '\.aws\credentials'
      - '\gh\hosts.yml'
  filter_main_legit:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
      - '\elevation_service.exe'
      - '\MsMpEng.exe'
      - '\claude.exe'
      - '\codex.exe'
      - '\cursor.exe'
      - '\Code.exe'
      - '\aws.exe'
      - '\gh.exe'
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Backup, EDR or DLP agents scanning browser profiles
  - Password-migration tools and browser import wizards
  - Developer tooling reading AWS or GitHub credential files
level: high

```

**Known false positives:**

- Backup, EDR or DLP agents scanning browser profiles
- Password-migration tools or profile-import wizards
- Developer tools reading AWS or GitHub credential files

**Tuning notes:** Requires Object Access > File System auditing with SACLs on browser profile directories and token files (Event 4663). Tune the process allow-list to your EDR and backup agents; raise the objects_touched threshold if noisy. Hits from unsigned binaries in user-writable paths should be escalated to session and token revocation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Browser Download Of Installer From Stealer Malvertising / ClickFix Infrastructure (locked: unlock with TL Creds)
- In-Memory Stealer Injection Into explorer.exe From User-Writable Path (Warden Loader) (locked: unlock with TL Creds)
- explorer.exe Outbound HTTPS To Rare Public Host - Injected Stealer Exfiltration (Warden) (locked: unlock with TL Creds)
- Fake Installer Lure Execution - MediaGet / CapCut / Trade-Journal MSI (Stealer Malvertising) (locked: unlock with TL Creds)
- Unsigned DLL Sideloading From User-Writable Path - Warden Loader / Acreed ShadowLoader (locked: unlock with TL Creds)
- DNS Resolution Of Community-Observed Stealer Malvertising And Relay Infrastructure (locked: unlock with TL Creds)
- ClickFix Run-Dialog Script Launch With Download Cradle - Infostealer Delivery (Warden / Acreed / Remus / Vidar) (locked: unlock with TL Creds)
- Non-Browser Dead-Drop C2 Resolution - Steam Profiles, BNB / Ethereum RPC, Telegram (Acreed / Remus) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Infostealers Weekly Report: 2026-10-26 - 2026-11-02 (Hudson Rock / Infostealers.com)](https://www.infostealers.com/report/infostealers-weekly-report-2026-10-26-2026-11-02/)
- [Warden Stealer Rust Infostealer Targets AI Coding-Agent Tokens (Gen Threat Labs analysis)](https://securityonline.info/warden-stealer-rust-infostealer/)
- [WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (GridinSoft)](https://blog.gridinsoft.com/warden-stealer-malware/)
- [New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows](https://cyberpress.org/new-warden-stealer-targets-330-apps/)
- [The Rise of Acreed Infostealer in the Post-LummaC2 Threat Landscape (Bitsight)](https://www.bitsight.com/blog/the-rise-of-acreed-infostealer)
- [Acreed infostealer (Intrinsec, TLP:CLEAR)](https://www.intrinsec.com/wp-content/uploads/2025/09/TLP-CLEAR-Sept-2025-Acreed-infostealer-EN.pdf)
- [Acreed: the new infostealer using BNB Smart Chain and Steam profiles for stealthy C2](https://securityonline.info/acreed-the-new-infostealer-using-bnb-smart-chain-and-steam-profiles-for-stealthy-c2/)
- [Remus Stealer: A New, Not-So-New Infostealer (Flashpoint)](https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/)
- [Inside the Remus infostealer: session theft MaaS and rapid evolution (BleepingComputer)](https://www.bleepingcomputer.com/news/security/inside-the-remus-infostealer-session-theft-maas-and-rapid-evolution/amp)
- [Vidar Stealer malware threat profile (Blackpoint Cyber)](https://blackpointcyber.com/threat-profile/vidar-stealer-malware-apg/)
- [Vidar Stealer and XMRig miner campaign analysis (Unit 42)](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/)
- [Infostealers now target AI tokens and API keys (SpyCloud)](https://spycloud.com/blog/infostealers-now-target-ai-tokens-and-api-keys/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5041