Acreed
Acreed is an information-stealing malware family / infostealer that gained rapid traction in 2025 and is described as one of the most prevalent active infostealer services that year, commonly ranked behind Lumma and alongside Rhadamanthys, Vidar, and StealC. Reporting states Acreed was first advertised on Russian Market in February 2025 by a user named "Nu####ez," and is assessed to be a private project. It has also been described as a newer stealer that quickly surpassed many established infostealers by Q1 2025. Acreed is associated with the broader infostealer ecosystem in which stolen logs are traded on Russian-speaking forums and underground markets. One source notes Acreed has links to Vidar, but no further technical detail is provided. The content consistently characterizes Acreed as infostealing malware; however, specific collection mechanisms, supported platforms, infection chain details, and concrete IOCs are not provided in the supplied material.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Credential Access
3 techniques
Credential Access
“...test stolen credentials across multiple services, and adjust tactics based on failed attempts without human input.” / “stolen credentials could be tested against thousands of endpoints simultaneously, including corporate VPNs, SaaS providers, and cloud services…”
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An active infostealer service cited as one of the more prevalent offerings in 2025.
Acreed is identified as an active infostealer service and one of the most prevalent infostealers in 2025.
An infostealer listed among the most active by infected hosts in 2025.
A newly discovered spyware toolkit that spreads rapidly via emails disguised as genuine messages or software updates, silently installing itself on compromised machines.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.