Three infostealer families in one two-month window, and the revived one had the volume

About five samples a day against one every three days: that is the distance between ACRStealer's throughput and AuraStealer's over the same 79-day collection window ^[6][7]. The ratio is roughly fifteen to one ^[6], and it runs the wrong way for anyone who triages by novelty. AuraStealer is the family ReversingLabs describes as actively maintained with recently improved anti-analysis work ^[2]. ACRStealer is the one that has drifted in and out of use for years ^[3]. The dormant-then-revived family is the one filling the sample queue.

Submission counts measure what a vendor collected, not what landed on endpoints, so treat the gap as a floor rather than a census. It still sets priorities. A detection backlog cleared in order of press attention would reach ACRStealer and its related Amatera strain, 478 samples between them ^[5][6], after finishing with the family that supplied 26.

The AuraStealer prompt is the more interesting piece of engineering, because of what it concedes. Before proceeding, the sample puts up a dialog asking for a randomised string, pxDpRf in the captured example, and ReversingLabs reads this as a measure against automated analysis ^[8]. Note the cost side. Every victim who declines to retype six characters is a lost infection, and the operator accepted that loss to defeat unattended detonation. That is a considered price, paid in conversions, and it is a reasonable proxy for how much the operator thinks a clean sandbox verdict is worth. Defenders whose pipeline ends at dynamic analysis get told nothing happened.

On RemusStealer, the hedge matters. ReversingLabs calls it a new potential variant of LummaStealer ^[4], not a confirmed one, and lineage is what determines whether existing Lumma detections and behavioural rules transfer. Lumma's documented tradecraft includes process hollowing and injection into trusted processes ^[12], which would carry over if the relationship holds and would not if it does not. The excerpt in front of us also stops mid-sentence before Remus's own sample count is given ^[16], so the third family's volume is simply unknown here. Two families with numbers and one without is the shape of the evidence, and it is worth saying so rather than implying a trio of equals.

The supply side explains the churn better than attacker skill does. These families are sold: subscriptions, lifetime licences, or affiliate arrangements where the author takes a cut ^[10], with no requirement that the buyer can write code ^[9], in a market ReversingLabs describes as behaving like any other, where competing vendors push products to the top ^[14]. Under those conditions a family going quiet says something about the vendor's business, not about demand, and a revival needs no new customers to be trained. Cataloguing families is therefore not the same work as reducing exposure.

What the loot list implies is the part that outlives any one family name. The standard haul includes credentials, personal data, crypto wallet material and session tokens, with documents, clipboard contents, recordings, browser cookies and application data on the more specialised end ^[11]. Session tokens and cookies do not care that the password was rotated afterwards. And the uses ReversingLabs lists for that data, leaked corporate documents, blackmail material, takeover of critical logins ^[15], are downstream of a single successful run by whichever of the three got through.