Infostealer malware now targets cracked software users

A recent analysis by AhnLab Security Intelligence Center highlights a growing cybersecurity threat from infostealer malware posing as cracked software and keygens, which are increasingly distributed through SEO-poisoned sites and legitimate web platforms, reports GBHackers News.

ASEC's automated detection tools, including crack monitoring and email honeypots, have enabled early identification of threats and C2 infrastructure, even ahead of platforms like VirusTotal. The report notes a shift in dominant malware, with LummaC2's presence declining and more evasive variants like ACRStealer, StealC, and Rhadamanthys gaining ground. Particularly, a new ACRStealer variant uses advanced anti-analysis features such as NT function spoofing and cross-architecture evasion. Attackers are also using unconventional delivery tactics, including fake installers and overlay windows that push phishing payloads. Some employ password-protected archives hidden in image files to bypass traditional detection. ASEC advises heightened vigilance and recommends utilizing its ATIP threat intelligence service for real-time updates and indicators of compromise across industries.