{"id":26172,"date":"2026-09-21T15:12:59","date_gmt":"2026-09-21T23:12:59","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/infostealers-highlight-malware-as-a-service-trend\/"},"modified":"2026-09-21T15:12:59","modified_gmt":"2026-09-21T23:12:59","slug":"infostealers-highlight-malware-as-a-service-trend","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/infostealers-highlight-malware-as-a-service-trend\/","title":{"rendered":"Infostealers highlight malware-as-a-service trend"},"content":{"rendered":"
\n
\n

Attackers are leveraging infostealer malware-as-a-service (MaaS) for a variety of attacks, with malware of this nature showing up regularly in a variety of campaign types. ReversingLabs found several specific infostealers being used recently: AuraStealer, a very actively updated and maintained stealer with recently improved anti-analysis features, ACRStealer, a long standing malware family that has fallen in and out of use, and RemusStealer, a new potential variant on the infamous LummaStealer.\u00a0<\/p>\n

The samples covered were active in July through August of 2026. Here are the top infostealer MaaS trends, and the families that ReversingLabs has been researching. The goal is to provide readers with important knowledge of these threats, how they manifest, and what they are capable of \u2014 all of which is vital to know in the current threat landscape.\u00a0\u00a0<\/p>\n

[ Get the report:\u00a0<\/strong>Copy, Paste, Compromise: The Tale of ClickFix<\/strong><\/a>\u00a0|\u00a0<\/strong>See the webinar<\/strong><\/a>\u00a0]<\/strong><\/p>\n

MaaS lowers the bar for attackers<\/h2>\n

Malware-as-a-service (MaaS) is becoming increasingly important in the security landscape. It lowers the barrier of entry for attackers, giving anyone access to malware without requiring coding knowledge. The MaaS market functions like any other market does, where the best products rise to the top. Vendors compete with each other to make the best products and grow their businesses. To engage in this massive market, potential customers can purchase subscriptions to the service, lifetime licenses, or join affiliate programs. Affiliate programs are common with ransomware-as-a-service, where the malware producer takes a cut of the earnings, and their customers, the ones doing the ransomware attack, take home the rest. The types of MaaS offered vary, with any type of malware being offered somewhere for a fee. Infostealers are especially popular, and are what this blog focuses on.\u00a0<\/p>\n

Infostealers do exactly what their name implies. Once installed, they take information from the device and exfiltrate it to the attacker. Common targets for infostealers include credentials, personal information, crypto wallet information, and session tokens. More specialized targets may include documents on the machine, clipboard data, recordings, browser cookies, or applications data. Since infostealers can exfiltrate a variety of things, attackers are able to leverage them in whatever way best suits their goals. These goals may be leaking documents with important corporate information, finding data to be used for blackmail, or compromising the logins for critical accounts. Any of these options could be disastrous for individuals or businesses. Whatever data the infostealer may be targeting, it is not information one would want to be revealed to threat actors.<\/p>\n

Another important feature of infostealers, especially the popular ones operating as MaaS, is their stealth and evasion. Some infostealers, such as LummaStealer<\/span><\/a>, use techniques like process hollowing and process injection<\/span><\/a>. These techniques involve putting malicious code into an existing, trusted process, avoiding detection. Users on the device will not be able to detect infostealer activity easily, without knowing what to look for. Many infostealers have basic anti-analysis functionality, can detect antivirus, sandboxing, or use of VMs, and will terminate themselves if signs point to them being analyzed. AuraStealer, which will be discussed later, gives the user a prompt before continuing, which is likely meant to combat automated analysis. <\/p>\n

\n