March 2026 Infostealer Report Details Windows DLL Side-Loading and macOS ClickFix
Summary
ASEC's March 2026 analysis found Windows infostealers mainly in EXE files, with DLL side-loading also observed. macOS activity included 472 Bash scripts, 117 C2 domains, ClickFix clipboard execution, and rapidly mutating samples.
Key points
- The report is based on ASEC automated collection and analysis and ATIP real-time IOC data covering Windows and macOS.
- About 82.6% of Windows samples were EXE files; 17.4% used DLL side-loading.
- Researchers collected 472 macOS Bash scripts and 117 C2 domains in March; samples reportedly changed hashes from minute to hour.
- ACRStealer, Vidar, and LummaC2 were the main infostealer families identified.
- Distribution methods included cracked software and keygens, SEO poisoning, and injected posts on forums and WordPress sites.
- One ACRStealer distribution used the Ren’Py game package to decrypt and execute an encrypted payload; macOS ClickFix activity used clipboard commands to trigger terminal execution.
- The report recommends stronger monitoring for DLL side-loading and ClickFix, alongside rapid automated collection and IOC sharing.
Article Details
- Publisher
- ASEC
- Report Period
- March 2026
- Scope
- Infostealer distribution trends and associated C2 information from Windows and macOS samples collected in March 2026.
- Sample Size
- 472 Bash scripts and 117 C2 domains were collected; the total sample count was not reported.
- Key Statistics
- Approximately 82.6% of Windows samples were EXE files.
- Approximately 17.4% of Windows samples used DLL side-loading.
- 472 macOS Bash scripts were collected in March 2026.
- 117 macOS C2 domains were collected in March 2026.
- macOS sample hashes changed on a minute-to-hour basis, according to the report.
- Recommendations
- Strengthen monitoring and validation for DLL side-loading and macOS ClickFix techniques.
- Maintain rapid automated collection and analysis, and provide real-time IOCs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 01706569197674576bd8459a635bbbc8 | MD5 hash listed as an Infostealer malware sample identifier. |
| MD5 | 0664c83d26c7a70b14b63e56328de1b7 | MD5 hash listed as an Infostealer malware sample identifier. |
| MD5 | 093771ca1cc11c3642c655a59c516144 | MD5 hash listed as an Infostealer malware sample identifier. |
| MD5 | 0a34954fc932945c63df0a35edc3075d | MD5 hash listed as an Infostealer malware sample identifier. |
| MD5 | 0ecfc065464fabe798831a323163ec09 | MD5 hash listed as an Infostealer malware sample identifier. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationRapidly mutating macOS samples had hashes that changed on a minute-to-hour basis, according to the report.T1036 · MasqueradingDLLs were modified to resemble legitimate counterparts and evade detection.T1059.004 · Unix ShellmacOS distribution used Bash scripts and ClickFix clipboard commands to trigger terminal execution.T1203 · Exploitation for Client ExecutionAn ACRStealer distribution exploited the Ren’Py game package to decrypt and execute encrypted data.T1204 · User ExecutionUsers were targeted with disguised cracked software and SEO-poisoned content.T1574 · Hijack Execution FlowDLL side-loading was used to load malicious code; DLLs were modified to resemble legitimate libraries.
Malware
ACRStealerMajor families identified include ACRStealer, Vidar, and LummaC2, with distribution via cracked software/SEO poisoning, forum/WordPress post injection, and an ACRStealer variant exploiting the Ren’Py game package.LummaC2Major families identified include ACRStealer, Vidar, and LummaC2, with distribution via cracked software/SEO poisoning, forum/WordPress post injection, and an ACRStealer variant exploiting the Ren’Py game package.VidarMajor families identified include ACRStealer, Vidar, and LummaC2, with distribution via cracked software/SEO poisoning, forum/WordPress post injection, and an ACRStealer variant exploiting the Ren’Py game package.