Loading story…
Researchers Jason Reaves and Joshua Platt reported new infrastructure and malware activity tied to MetaStealer, identifying a new wordlist-based domain generation algorithm while confirming the malware’s older DGA is still active. Their analysis found MetaStealer gate servers are largely domain-agnostic and depend more on IP address, port, URI, and HTTP headers to relay traffic, indicating operators can shift domains without significantly changing backend behavior.
The investigation also uncovered a related Windows payload called RuntimeSync, described internally as a “tracker” and still appearing to be under development. The malware includes backdoor and RAT functions such as keylogging, screenshot and desktop video capture, file upload, self-updating, and remote command execution, and it uses its own DGA for communications. Researchers said the analyzed routine used a hardcoded seed, generated 1,000 domains from a 101-word list with width three, and used the hardcoded TLD com; they also published network and endpoint indicators for both MetaStealer and RuntimeSync.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Jason Reaves and Joshua Platt published analysis of new infrastructure and malware activity linked to MetaStealer, including a new wordlist-based DGA while noting the older DGA remains active. The report also identified an in-development Windows payload called RuntimeSync with backdoor/RAT capabilities and provided network and endpoint indicators for both malware families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **MetaStealer** infection chain delivered through malicious email attachments and links, including Excel macro documents and OneNote files, that infected Windows systems and established persistence for follow-on payload delivery. In the observed campaigns, enabling macros or opening the lure file launched scripts that retrieved components from **GitHub** and **transfer.sh**, built a persistent executable on the host, and modified `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` so the malware would restart after reboot. Analysts said the infrastructure remained active near the time of publication, and network traffic to `193.106.191.162:1775` matched **EmergingThreats Pro** detections for Win32/MetaStealer activity. Separate reverse engineering showed MetaStealer used **XOR-based string decryption** and a **domain generation algorithm (DGA)** to supplement or replace static command-and-control infrastructure by generating multiple `.xyz` domains for beaconing. Decrypted strings and observed behavior indicated capabilities beyond credential theft, including **SOCKS proxying, backconnect access, firewall rule manipulation, shellcode execution, and tasking endpoints**, underscoring that MetaStealer functioned as a flexible post-compromise stealer and access tool rather than a simple infostealer.
Aug 15, 2026
Breakglass Intelligence reported that **ACRStealer** is running an active credential-theft operation through multiple delivery chains, including a compromised `.edu` WordPress site and a trojanized **Chris-PC RAM Booster** installer. The malware uses a four-stage infection flow that progresses from PowerShell or installer-based execution to Go and .NET loaders, then decrypts and injects shellcode in memory. Researchers said newer samples introduced a previously undocumented .NET loader, **CoreHubManager**, a new 16-byte XOR key, **AES-256-CBC** shellcode decryption, and **Heaven’s Gate** WoW64 transitions to run x64 code from a 32-bit process. Payloads were also signed with a stolen **ASUSTeK EV code-signing certificate**, allowing binaries such as `sunwukongs.exe` to better evade SmartScreen and other trust controls. Once installed, ACRStealer steals credentials, browser data, DPAPI-protected secrets, Windows Hello NGC keys, smart card certificates, Azure AD OAuth tokens, wallets, documents, and tokens from more than 200 applications, then exfiltrates the data over HTTPS. The malware also uses custom AFD socket operations and dead-drop resolvers hosted on **Steam**, **Google Docs/Slides**, and **Telegram** pages to retrieve command-and-control infrastructure. Breakglass mapped **17 C2 IPs** in the newer cluster and **9 live C2 servers** in the earlier campaign, with the larger set hosted by **VDSINA**, pointing to a concentrated infrastructure footprint. Researchers also found overlap with **SectopRAT**, **AmateraStealer**, **NetSupport RAT**, **OffLoader**, **HIjackLoader/IDATLoader**, and **ClickFix/FakeCAPTCHA** chains, and said ACRStealer has been rebranded as **AmateraStealer** and marketed as a malware-as-a-service offering.
Jun 29, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026