Acreed Infostealer Gaining Popularity Among Cybercriminals for C2 via Steam Platform

Acreed, a novel infostealer first observed in February 2025, has rapidly gained traction among threat actors seeking discreet credential and cryptocurrency data harvesting. Leveraging a unique command-and-control mechanism via the Steam platform’s community profiles, Acreed exhibits advanced OPSEC measures and versatility that distinguish it from established stealers such as Lumma, according to Intrinsec.

It was noted on Russian underground markets on 14 February 2025, sold exclusively by the threat actor known as Nuez, and within months it displaced other stealers, capturing 17% of log sales by September 2025. Its ascent accelerated after the global takedown of Lumma in May 2025, underscoring its appeal as a low-visibility alternative, with logs described as compact and containing passwords, cookies, autofill data and potentially encrypted wallet information.

Acreed implements dual dead-drop C2 mechanisms, retrieving domains via a BNB Smart Chain testnet contract and, alternatively, by XOR-decoding a hardcoded Steam profile URL to obtain C2 domains such as trustdomainnet[.]live and trusteddomain[.]win.