AhnLab Report Details June Infostealer Trends, Distribution Methods and macOS Tactics
Summary
AhnLab’s June 2026 report describes infostealer distribution through file-sharing sites, search poisoning and email, along with macOS campaigns using ClickFix, Bash scripts and a smart-contract-based method for retrieving C2 addresses.
Key points
- AhnLab says its findings were based on samples collected through automated collection, an email honeypot and automated malware C2 analysis systems.
- The report identified Remus, ACRStealer, LummaC2 and Vidar, commonly distributed through MediaFire, Mega and other cloud-storage sites.
- EXE files accounted for about 84.5% of observed execution types; DLL side-loading accounted for about 15.5%.
- macOS distribution included ClickFix prompts to run commands in Terminal and malicious Bash scripts; one method queried Polygon smart contracts for C2 addresses and created a LaunchAgent plist.
- Email campaigns used compressed attachments to deliver AgentTesla and DarkCloud, which the report says transmitted information via SMTP.
- Microsoft was the most frequently impersonated company; AhnLab warns stolen information may be traded or used in follow-on attacks.
Article Details
- Publisher
- AhnLab SEcurity intelligence Center (ASEC)
- Report Period
- June 2026
- Scope
- Infostealer distribution channels, detections, execution types, and companies impersonated in samples collected during June 2026.
- Key Statistics
- EXE accounted for approximately 84.5% of execution types; DLL side-loading accounted for approximately 15.5%.
- Four malicious Bash scripts for macOS were collected in June 2026.
- Recommendations
- Avoid untrusted links and attachments and avoid using illegal software.
- Be mindful of browser storage features and encrypt important documents.
- Change passwords periodically and use two-factor authentication.
- Keep security software up to date.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apdhlhs3[.]xyz | FQDN listed in the report's indicator section in an infostealer trend report. |
| DOMAIN | bduwih8[.]pro | FQDN listed in the report's indicator section in an infostealer trend report. |
| DOMAIN | johncon[.]my | FQDN listed in the report's indicator section in an infostealer trend report. |
| MD5 | 02c7d78e6c5816f1df250f995a776aa2 | MD5 hash listed in the report's indicator section for collected infostealer samples. |
| MD5 | 03663f2f81da94cd204837e4bde772ff | MD5 hash listed in the report's indicator section for collected infostealer samples. |
| MD5 | 03e99ceede013fe1b50a0e06c1f0a02c | MD5 hash listed in the report's indicator section for collected infostealer samples. |
| MD5 | 042db31ea5443d78aeee714556813a28 | MD5 hash listed in the report's indicator section for collected infostealer samples. |
| MD5 | 04d91c168c7617c38199983858cfbb4e | MD5 hash listed in the report's indicator section for collected infostealer samples. |
Malware
ACRStealerIn June, Remus, ACRStealer, LummaC2, and Vidar were distributed.AgentTeslaIn email-based distribution cases, AgentTesla was identified in emails disguised as messages from a Japanese materials company, while DarkCloud was found in emails posing as messages from an Indian electronics componentAtomic macOS Stealer (AMOS)AMOS AMOSStealer 동향 Infostealer 인포스틸러 인포스틸러동향 LummaC2 Remus RemusStealer Vidar VidarStealerDarkCloudAgentTesla was identified in emails disguised as messages from a Japanese materials company, while DarkCloud was found in emails posing as messages from an Indian electronics component manufacturer.LummaC2In June, Remus, ACRStealer, LummaC2, and Vidar were distributed.RemusIn June, Remus, ACRStealer, LummaC2, and Vidar were distributed.VidarIn June, Remus, ACRStealer, LummaC2, and Vidar were distributed.