New ACRStealer Variant Uses Syscall Evasion, TLS C2 and Secondary Payload Delivery

A new variant of ACRStealer has emerged with upgraded capabilities that make it significantly harder to detect and more dangerous to the systems it targets.

First reported by Proofpoint in early 2025 as a rebranded version of the Amatera Stealer, this latest iteration introduces low-level syscall evasion, encrypted C2 communication over TLS, and the ability to deliver secondary payloads — a combination that marks a clear step forward in the malware’s development and points to an actively maintained threat.​

ACRStealer is sold as a Malware-as-a-Service (MaaS), meaning it is rented out to multiple threat actors for use in their own campaigns.

In this latest operation, it arrives as a final payload delivered through HijackLoader — a sophisticated loader tied to the PiviGames distribution platform.

The attack begins when users on gaming platforms like Steam, Discord, or Reddit are tricked into visiting a malicious link (hxxps://pivigames..blog/adbuho), which takes them through a redirection chain before dropping a ZIP archive containing the malware, disguised as a legitimate software installer.​

G Data analysts identified this updated ACRStealer variant during a follow-up investigation into HijackLoader activity and noted key differences from earlier versions.

Where past iterations relied on a Dead Drop Resolver (DDR) to hide C2 server addresses, this sample connects to its command infrastructure using native Windows kernel interfaces and encrypted channels, removing a detection point that many security tools previously relied on.

Their analysis confirmed active infections in the United States, Mongolia, and Germany, with all samples communicating back to the C2 address 157..180..40..106.​

The data-stealing reach of this variant is broad. It targets browser credentials, session cookies, and login data from multiple browsers, and uniquely goes after Steam gaming account credentials — an exfiltration target not previously observed in ACRStealer campaigns.

Stolen data is written to a hardcoded file named d5e48e78-2951-4117-b806-e4f8e626f28c.txt before being transmitted to the C2 server.

The malware also performs full system fingerprinting, capturing machine GUID, username, architecture, locale, and build time, compressing everything into an in-memory ZIP archive capped at 40MB before final transmission.​

The same delivery infrastructure has also been observed pushing LummaStealer in early 2026, with the PiviGames chain now redirecting to a Mega cloud download containing a single executable named Setup.exe — this time deploying LummaStealer instead of ACRStealer.

This rotation confirms the threat group is actively swapping out its final payload without rebuilding its distribution chain, making the operation flexible and difficult to disrupt with payload-specific detection alone.​

Syscall Evasion and C2 Communication

The most technically notable aspect of this variant is how it avoids detection at the API level.

Rather than relying on standard Win32 APIs that endpoint tools routinely monitor, it locates ntdll.dll through the Process Environment Block (PEB) and manually parses the Export Address Table (EAT) to resolve the functions it needs, using a modified djb2 hash algorithm also observed in HijackLoader.

System calls are then executed through the WoW64 transition gate, routing them at the kernel level and bypassing the user-mode hooks that most security products depend on.

On the network side, ACRStealer avoids the standard Winsock library entirely. It manually constructs an AFD endpoint path and opens it via NtCreateFile, building a raw TCP IPv4 socket without importing ws2_32.socket.

Once connected to the C2 server at port 443, the malware completes a TLS handshake through Microsoft’s SSPI framework, using the hardcoded hostname playtogga..com — a real soccer platform — to make its traffic look like normal HTTPS activity and blend past network inspection tools. 

After the handshake, data is sent either in plaintext or AES-256 encrypted form depending on a runtime configuration flag. If the C2 server becomes unreachable, the malware waits two seconds and retries automatically, giving it basic resilience.

Security teams are advised to monitor for unusual low-level API usage including NtCreateFile and AFD-based network connections, block the known C2 indicators 157..180..40..106 and playtogga..com, and enable behavioral detection for process hollowing via rundll32.exe.

Users should avoid downloading files from unverified links shared on gaming platforms or social media.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.