Acreed Infostealer Gaining Popularity Among Cybercriminals for C2 via Steam Platform
Acreed, an emerging infostealer first detected in February 2025, has quickly become prominent among cybercriminals for its ability to discreetly harvest credentials and cryptocurrency data.
Acreed, an emerging infostealer first detected in February 2025, has quickly become prominent among cybercriminals for its ability to discreetly harvest credentials and cryptocurrency data.
The malware utilizes a distinctive command-and-control (C2) approach through the Steam platform’s community profiles, demonstrating advanced operational security (OPSEC) and versatility compared to other stealers like Lumma.
Initially introduced to Russian underground markets on February 14, 2025, Acreed is exclusively distributed by the threat actor known as Nuez.
By September 2025, Acreed had captured 17% of log sales, ranking it third behind Rhadamanthys and Lumma.
Following the dismantling of Lumma in May 2025, Acreed became a preferred option due to its low visibility.
Acreed generates small log files containing only essential data, such as passwords, cookies, autofill data, and potentially encrypted wallet information, which contrasts with the larger logs produced by other stealers.
Acreed employs two dead-drop resolver techniques to retrieve its C2 domain:
BNB Smart Chain Testnet: The malware queries a smart contract on the BNB testnet to extract an XOR-encoded hex string, decoding it to domains like windowsupdateorg.live . This contract is used to dynamically update C2 domains.
Steam Platform Comments: Some samples decode a hardcoded payload to a Steam Community profile URL. The malware fetches comments from this profile, extracting hex strings to derive domains such as trustdomainnet.live and trusteddomain.win for C2 communications.
Initially introduced to Russian underground markets on February 14, 2025, Acreed is exclusively distributed by the threat actor known as Nuez.
After retrieving the C2 information, Acreed executes JavaScript modules from these domains to perform:
Cryptocurrency Clipping: Replacing wallet addresses in web pages and QR codes with attacker wallets.
Clipboard Hijacking: Monitoring and altering wallet strings in the clipboard.
Screenshot Exfiltration: Capturing and transmitting user screen images via TLS-encrypted POST requests.
Analysis links Acreed’s C2 IP 186.2.166.198 with a hosting cluster managed by ProManaged LLC in the UAE, associated with Vidar stealer infrastructure from early 2023.
Communications occur via HTTP GET or HTTP POST requests on port 443.
Evasion and Persistence: Utilizing Steam’s community feature as a dead drop helps evade detection and takedown efforts.
Opportunistic Distribution: The small log size and private distribution on Russian marketplaces minimize exposure to researchers.
Credential and Crypto Theft: Targeting both browser credentials and cryptocurrency wallets increases potential financial damage.
Monitor Unusual HTTPS Requests: Detect outgoing TLS traffic to suspicious domains mimicking legitimate services.
Harden Browser Security: Implement browser extension allowlists and restrict credential storage in autofill.
Network Egress Filtering: Block HTTP(S) requests to known Steam community profiles used for dead drops.
Threat Hunting Indicators: Deploy indicators of compromise (IOCs) such as mutex names, user agents, and known C2 domains to detect Acreed infections.
Acreed’s innovative use of blockchain and gaming-platform dead drops, combined with lightweight data exfiltration techniques, makes it a significant threat in the infostealer landscape. Its infrastructure's connection with established malware families emphasizes the need for adaptive defenses. Continuous monitoring and rapid IOC sharing are crucial to countering Acreed’s evolving campaigns.
Based on reporting by GBHackers.