Active threat familyWindowsCredential theft
Malware Intelligence

Acreed

Acreed is an infostealer that appeared in February 2025 with log sales on Russian Market. After the Lumma operation in May 2025, its share of the log market grew rapidly. It resolves its command server address through the BNB Smart Chain testnet and Steam; its infrastructure overlaps with the Vidar ecosystem.

Activity map

Activity mapPackagingExfiltrationAcreedInfostealerData collection6 targetsLog archiveC2 server
Malicious payloadAcreed · Infostealer

Acreed is an infostealer that appeared in February 2025 with log sales on Russian Market. After the Lumma operation in May 2025, its share of the log market grew rapidly. It resolves its command server address through the BNB Smart Chain testnet and Steam; its infrastructure overlaps with the Vidar ecosystem.

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software

Credentials and application data

  • Saved passwords
  • Session cookies
  • Session refresh data
  • Autofill
  • Saved cards
Dark Radar infection records
122,902
Latest infection record
29 October 2026
Malware type
Infostealer
First seen
February 2025
01

Overview

Ranks 15 of 52 families in Dark Radar data, with 122,902 infection records.

02

Origin and evolution

  1. February 2025A single seller account on Russian Market began selling Acreed logs.LastPass (Flashpoint verisi)
  2. May 2025After the law enforcement operation against Lumma, it became the second family after Lumma in the Russian log market.The Record (ReliaQuest araştırması)
  3. September 202518 samples and the command server resolution method were published; one server was shown to overlap with Vidar infrastructure.Intrinsec
03

Technical profile

Malware typeInfostealer
Target operating systemWindows
Primary purposeData theft
Threat categoryCredential theft
Distribution modelClosed use; not seen sold as a service
First seenFebruary 2025
Infected systemsWindows 11 48.5%, Windows 10 33.5%
Public source confidenceMedium
04

Targeted applications

6 applications2 categories
05

Data collection

Credentials

  • Browser passwords100%Verified
  • Session cookies97.5%Verified
  • Refreshing expired sessions75%Dark Radar observation
  • Autofill93%Verified
  • macOS Keychain—
  • 2FA and password managers—

Financial

  • Saved cards8.5%Dark Radar observation
  • Desktop crypto walletsReported
  • Wallet extensions—
  • Clipboard address replacement—

System

  • File collection—
  • Screenshot—
  • System inventory100%Dark Radar observation
06

File system

User profile (%USERPROFILE%)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

How it works

  1. 1Execution and evasion

    T1140Deobfuscate/Decode Files or Information

    Breaking point: Unsigned files running from user folders and injections into .NET tools are stopped by application control and EDR.

  2. 2Discovery

    Dark Radar observation

    Infected systems: Windows 11 48.5%, Windows 10 33.5%.

    T1082System Information Discovery

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  3. 3Data collection

    • Browser passwords, session cookies and autofill data are collected; browsing history and downloads are not taken.
    Dark Radar observation

    Data found in the latest 200 logs: password file 100%, cookies 97.5%, autofill 93%, cards 8.5%.

    T1555.003Credentials from Web BrowsersT1539Steal Web Session Cookie

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  4. 4Exfiltration and C2

    • The command server address is stored XOR-encrypted inside the malware; the current address is read from a record on the BNB Smart Chain testnet and from a Steam profile.
    T1102.001Dead Drop ResolverT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

08

Network communication

This section is in Dark Radar IntelligenceOpen in Intelligence
09

MITRE ATT&CK

Credential Access
Discovery
Defense Evasion
Command and Control
Exfiltration
10

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
11

Risk and impact

  • Logs reach the market through a single seller at regular intervals; the data from an infection can be offered for sale within a short time.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
12

Defense

  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
13

Learning center

How does this malware spread?
  • Infostealer families mostly spread through unlicensed software, fake updates, sponsored search ads and phishing emails.
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which Windows artifacts should be examined?
  • Prefetch (C:\Windows\Prefetch) — shows that a short-lived payload ran.
  • Amcache.hve and ShimCache — path and hash of the executed file.
  • Downloads folder and Zone.Identifier stream — the address the file was downloaded from.
  • Browser history — the fake download page or fake CAPTCHA address.
  • RunMRU registry key — commands pasted into the Run dialog.
  • Randomly named folders and DLLs under %TEMP% and %LOCALAPPDATA%.
Which log records matter?
  • Sysmon Event 1 / Security 4688Process creation: unsigned processes starting from Temp and Downloads folders, mshta, powershell -enc chains.
  • Sysmon Olay 11 / 23File creation and deletion: self-deleting payloads, DLLs dropped under Temp.
  • Sysmon Olay 3 / 22Network connection and DNS query: to newly registered domains, C2 resolution via Telegram, Steam or Pastebin.
  • Object access auditing (4663)A process other than the browser reading Login Data, Cookies and Local State files.
  • PowerShell 4104Script block logging: obfuscated downloader commands.
  • Identity provider sign-in logsSessions after the infection from a different country and device, without a multi-factor authentication prompt.
Which MITRE techniques is it associated with?
T1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1082System Information DiscoveryT1140Deobfuscate/Decode Files or InformationT1102.001Dead Drop ResolverT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
14

Sources

From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans