Acreed: The New Infostealer Using BNB Smart Chain and Steam Profiles for Stealthy C2

Acreed is a new infostealer that, according to Intrinsec’s latest report, is rapidly gaining traction in Russian-speaking forums and could challenge established threats. The researchers note that Lumma dominated the market for much of 2024, but its global takedown in May 2025 left a power vacuum that Acreed has begun to fill, with the ability to log 17% of the underground market behind Rhadamanthys.

Intrinsec identified 18 Acreed samples and uncovered innovative C2 domain retrieval methods that use the BNB Smart Chain Testnet and Steam profiles as dead drop resolvers. The malware’s logs are minimal, containing only passwords, cookies and autofill data, described as a “small footprint” that increases discretion.

Beyond credentials, Acreed aggressively targets digital assets with JavaScript modules acting as clipper malware to replace wallet addresses in real time, including wallets such as MetaMask, Coinbase, Binance, Phantom and Ronin. The report also points to overlap with the Vidar ecosystem and connections to ProManaged LLC, suggesting the infrastructure could facilitate wider distribution within the cybercrime community.