Security1 distinct publisher3 min readPublished
ReversingLabs counted 397 ACRStealer samples against 26 for the freshly updated AuraStealer. In a rented-malware market, the newest family is not the busiest one.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
About five samples a day against one every three days: that is the distance between ACRStealer's throughput and AuraStealer's over the same 79-day collection window [6][16]. The ratio is roughly fifteen to one [6], and it runs the wrong way for anyone who triages by novelty. AuraStealer is the family ReversingLabs describes as actively maintained with recently improved anti-analysis work [2]. ACRStealer is the one that has drifted in and out of use for years [3]. The dormant-then-revived family is the one filling the sample queue.
Submission counts measure what a vendor collected, not what landed on endpoints, so treat the gap as a floor rather than a census. It still sets priorities. A detection backlog cleared in order of press attention would reach ACRStealer and its related Amatera strain, 478 samples between them [5][6], after finishing with the family that supplied 26.
The AuraStealer prompt is the more interesting piece of engineering, because of what it concedes. Before proceeding, the sample puts up a dialog asking for a randomised string, pxDpRf in the captured example, and ReversingLabs reads this as a measure against automated analysis [7]. Note the cost side. Every victim who declines to retype six characters is a lost infection, and the operator accepted that loss to defeat unattended detonation. That is a considered price, paid in conversions, and it is a reasonable proxy for how much the operator thinks a clean sandbox verdict is worth. Defenders whose pipeline ends at dynamic analysis get told nothing happened.
On RemusStealer, the hedge matters. ReversingLabs calls it a new potential variant of LummaStealer [4], not a confirmed one, and lineage is what determines whether existing Lumma detections and behavioural rules transfer. Lumma's documented tradecraft includes process hollowing and injection into trusted processes [11], which would carry over if the relationship holds and would not if it does not. The excerpt in front of us also stops mid-sentence before Remus's own sample count is given [14], so the third family's volume is simply unknown here. Two families with numbers and one without is the shape of the evidence, and it is worth saying so rather than implying a trio of equals.
The supply side explains the churn better than attacker skill does. These families are sold: subscriptions, lifetime licences, or affiliate arrangements where the author takes a cut [9], with no requirement that the buyer can write code [8], in a market ReversingLabs describes as behaving like any other, where competing vendors push products to the top [13]. Under those conditions a family going quiet says something about the vendor's business, not about demand, and a revival needs no new customers to be trained. Cataloguing families is therefore not the same work as reducing exposure.
What the loot list implies is the part that outlives any one family name. The standard haul includes credentials, personal data, crypto wallet material and session tokens, with documents, clipboard contents, recordings, browser cookies and application data on the more specialised end [10]. Session tokens and cookies do not care that the password was rotated afterwards. And the uses ReversingLabs lists for that data, leaked corporate documents, blackmail material, takeover of critical logins [15], are downstream of a single successful run by whichever of the three got through.
Ranked by verification strength, evidence, and original report placement.
ReversingLabs states the infostealer samples it covered were active in July through August of 2026.
ReversingLabs describes AuraStealer as a very actively updated and maintained stealer with recently improved anti-analysis features.
ACRStealer is described as a long standing malware family that has fallen in and out of use.
RemusStealer is described as a new potential variant on LummaStealer.
ReversingLabs databases show that between June 1st and August 18th, AuraStealer had 26 samples submitted and ACRStealer had 397, with an additional 81 for the related Amatera family.
ACRStealer and Amatera together account for 478 samples in the window; ACRStealer's 397 is about 15.3 times AuraStealer's 26, working out to roughly 5.0 ACRStealer samples per day against about 0.33 per day for AuraStealer, or one every three days.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Specific vendor telemetry, single source, one internal contradiction
The numbers are precise and method-labelled (unique executables first seen in a fixed window) and are backed by a screenshot and a timeline figure, which is better than anecdote. But everything rests on one vendor-authored post with no independent corroboration, the counts measure submissions to a proprietary corpus rather than infections, the supplied body is truncated mid-sentence, and the cluster's own derived reading of the Remus figure is contradicted by the source text.
Real sample volume, but vendor-corpus scoped
There is a genuine quantified activity signal: 1,110 first-seen unique samples across the three families and Amatera in a 79-day window, with RemusStealer and ACRStealer clearly in active circulation and AuraStealer at roughly one new sample every three days. This is measured artifact volume in one vendor's collection, not measured infections, victims or campaign counts, so it establishes that these MaaS families are in live use without establishing scale of impact.
Framing overstates the revived family's lead
Positive because the headline framing — three families in one window and 'the revived one had the volume' — is overstated relative to the source's own data: RemusStealer, the newest family, led with 606 samples versus ACRStealer's 397, so the newest family was in fact the busiest. The ACRStealer-versus-AuraStealer ratio is arithmetically sound but selective. The underlying descriptive claims about MaaS economics and evasion are conventional and not inflated, which keeps the gap moderate rather than severe.
Vendor-owned data, vendor-owned funnel
The sole source is a commercial security vendor publishing prevalence figures derived exclusively from its own databases, with a Spectra Assure 14-day free trial call-to-action at the top, a gated report and webinar link inline, and the activity-timeline figure generated by its own Spectra Intelligence MCP tooling. The material that establishes the threat is also the material that sells the product measuring it, and no disclosure or independent check offsets that alignment.
Plausible and specific, but unverified and internally inconsistent
Moderate-low. The technical description of infostealer MaaS behaviour is consistent with well-established patterns and the counts are stated with unusual precision, so the direction of the story is credible. Confidence is capped by single-source dependence on interested telemetry, the truncated source body, the mismatch between the stated July-August activity period and the June 1-August 18 counting window, and the contradicted claim about RemusStealer's volume.
security
The AsyncAPI backdoor shipped with valid provenance, because the official pipeline built it1 distinct publisher
security
66% of mobile banking trojans now take the whole device, and 45% ask for a ransom1 distinct publisher
build
One unsigned parent, dozens of children: why image signing keeps losing to scanning1 distinct publisher
security
A year of Sophos AI cases: 30 of 38 were fake installers, not autonomous attackers1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 26, 2026