AhnLab’s February 2026 Report Tracks Infostealer Distribution Trends
Summary
AhnLab ASEC’s February 2026 report describes SEO-poisoned infostealer distribution, Windows and macOS delivery methods, and a rise in Inno Setup downloader samples from 5,323 in January to 13,211 in February.
Key points
- AhnLab ASEC says it uses automated malware collection, email honeypots, and C2 analysis, with related indicators available through its ATIP service.
- The report describes attackers using SEO-poisoned posts on legitimate sites, forums, Q&A pages, and poorly managed WordPress sites to distribute infostealers.
- Reported Windows distribution was approximately 74.8% EXE files and 25.2% DLL sideloading.
- macOS delivery included ClickFix-style terminal commands, Bash scripts, and osascript; AhnLab collected 2,073 Bash scripts, 217 fatbin executables, and 31 C2 domains in February.
- Inno Setup downloader samples rose from 5,323 in January to 13,211 in February; the report says the campaign used PowerShell to fetch additional payloads, including ACRStealer.
- ACRStealer, LummaC2, and Vidar were among the infostealers primarily distributed disguised as cracks and keygens.
Article Details
- Publisher
- AhnLab ASEC
- Report Period
- February 2026
- Scope
- Infostealer distribution trends, collection, and analysis, including Windows and macOS distribution methods and Inno Setup downloader campaigns.
- Sample Size
- Not disclosed as a total; the report separately gives collection counts for specific malware types.
- Key Statistics
- In February, approximately 74.8% of the reported Windows Infostealer samples were EXE-type and 25.2% used DLL side-loading.
- In February, 2,073 macOS Bash scripts, 217 Fatbin executables, and 31 C2 domains were collected.
- Inno Setup downloader distribution increased from 5,323 samples in January to 13,211 in February.
- Recommendations
- Exercise caution with DLL side-loading samples, which the report says may closely resemble legitimate files.
- Use the report’s statistics to identify trends in Infostealer distribution methods and disguise techniques.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 03f9b573497f7161f248a01576af66d6 | MD5 hash listed among collected malware sample hashes. |
| MD5 | 049f6afa92e1a62413f7ec566b7bef75 | MD5 hash listed among collected malware sample hashes. |
| MD5 | 04f4537b1f73eeacae2eb8faf7cbf993 | MD5 hash listed among collected malware sample hashes. |
| MD5 | 0a4aed360e1279500992e8099bc5018f | MD5 hash listed among collected malware sample hashes. |
| MD5 | 0dbdaf5d20105ade99d10ec45fbeb26b | MD5 hash listed among collected malware sample hashes. |
| URL | hxxp[:]//electrico[.]co[.]zw/wp-templates/five/five/fre[.]php | Distribution landing page identified in the report as delivering malware. |
MITRE ATT&CK
T1036 · MasqueradingInfostealers are disguised as cracks, keygens, or legitimate installers.T1059.001 · PowerShellPowerShell commands download and execute additional malicious programs.T1059.004 · Unix ShellBash scripts are used to deliver and execute macOS Infostealers.T1059.005 · Visual BasicSome macOS samples use osascript to execute payloads.T1105 · Ingress Tool TransferAdditional malicious programs, including ACRStealer, are downloaded to the victim environment.T1204.002 · Malicious FileUsers are induced to click an installer’s “Next” button, triggering download and execution of malicious code.T1574.001 · DLLAttackers place a malicious DLL beside a legitimate executable so it loads when the executable runs.
Malware
ACRStealerThe report notes significant activity from ACRStealer and a surge in Inno Setup downloader campaigns that use PowerShell to fetch additional payloads.LummaC2In February, ACRStealer, LummaC2, and Vidar Infostealer were primarily distributed.VidarIn February, ACRStealer, LummaC2, and Vidar Infostealer were primarily distributed.