ASEC Report Details July 2026 Infostealer Distribution Trends
Summary
ASEC’s July 2026 report tracks infostealer distribution and impersonation trends, including malware spread through cracks, file-sharing services, MSBuild, DLL side-loading, and phishing emails.
Key points
- The report draws on ASEC’s automated collection system, email honeypots, C2 analysis, and AhnLab product diagnostic logs.
- Remus, LummaC2, ACRStealer, and Vidar were distributed disguised as cracks and illegal software; reported distribution domains included Mega, Amazon S3, and MediaFire.
- Microsoft was the most frequently impersonated company, followed by AnyDesk, AO Kaspersky Lab, OpenAudible, and Samsung.
- EXE files accounted for about 89.6% of execution types, while DLL side-loading accounted for about 10.4%.
- Some MSBuild campaigns used a bundled executable, project file, and malicious DLL to run a payload and contact a C2 server for further downloads.
- Email attachments disguised as business correspondence delivered MassLogger and Agent Tesla, which can steal credentials and other user information.
- ASEC recommends avoiding cracks and untrusted attachments, protecting stored credentials and files, using two-factor authentication, and keeping security software updated.
Article Details
- Publisher
- Asec Ahnlab
- Report Period
- July 2026
- Scope
- Infostealer distribution channels, disguising techniques, execution types, detections, and impersonated companies, based on ASEC automated data collection, email honeypots, C2 analysis, and AhnLab product diagnostic logs.
- Key Statistics
- EXE files accounted for approximately 89.6% of observed execution types.
- DLL side-loading accounted for approximately 10.4% of observed execution types.
- Recommendations
- Avoid untrusted links and email attachments.
- Avoid using cracks and keygens.
- Use caution when saving account information in browsers.
- Use file encryption to protect important documents.
- Change passwords periodically, use two-factor authentication, and keep security software up to date.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 0112f48dc1be973944db6945e13063c6 | MD5 hash listed in the report's indicator section. |
| MD5 | 01509719f083e2ba66f95cc9b0daf9e2 | MD5 hash listed in the report's indicator section. |
| MD5 | 01abca3febcbc0ae661ae467ffc51623 | MD5 hash listed in the report's indicator section. |
| MD5 | 01e298bdc100ec212290064b750fe980 | MD5 hash listed in the report's indicator section. |
| MD5 | 0231a69822233302d04603f7985519d3 | MD5 hash listed in the report's indicator section. |
MITRE ATT&CK
Malware
ACRStealerIn July, the Remus, LummaC2, ACRStealer, and Vidar infostealers were distributed by disguising them as cracks and illegal software.AgentTeslaThe Attachment in the first case contained MassLogger, while the Attachment in the second case contained AgentTesla.LummaC2In July, the Remus, LummaC2, ACRStealer, and Vidar infostealers were distributed by disguising them as cracks and illegal software.MassLoggerThe Attachment in the first case contained MassLogger, while the Attachment in the second case contained AgentTesla.RemusIn July, the Remus, LummaC2, ACRStealer, and Vidar infostealers were distributed by disguising them as cracks and illegal software.VidarIn July, the Remus, LummaC2, ACRStealer, and Vidar infostealers were distributed by disguising them as cracks and illegal software.