June 2026 Infostealer Trend Report

What Happened

This monthly report from security firm AhnLab (ASEC) summarizes how information-stealing malware (software that secretly copies passwords, browser data, and other sensitive information from a computer) spread during June 2026. Both everyday computer users - especially those downloading pirated or cracked software - and employees at companies were affected, on both Windows and Mac computers. This matters because stolen information can be sold on the dark web or used to launch further attacks against victims or their employers. People should avoid downloading illegal/cracked software, be cautious with email attachments and links, turn on two-factor authentication (a second login step beyond just a password), and keep security software updated.

Key Takeaways

• Infostealers Remus, ACRStealer, LummaC2, and Vidar were widely distributed in June 2026, primarily via cracks/keygens promoted through SEO poisoning and hosted on file-sharing sites like Mediafire and Mega.
• Approximately 84.5% of observed attacks used EXE files while ~15.5% used DLL side-loading, abusing legitimate-looking DLL names such as python37.dll, LcMgr.dll, and python315.dll.
• A macOS-targeting variant evolved to dynamically resolve C2 addresses via Polygon blockchain smart contract data, and establishes persistence by creating a .plist LaunchAgent.
• ClickFix social engineering (tricking users into pasting and running malicious commands in Terminal) and malicious Bash script downloads were used against macOS users; four such scripts were collected in June.
• Email-based campaigns delivered AgentTesla and DarkCloud stealers via compressed attachments impersonating a Japanese materials company and an Indian electronics components manufacturer, exfiltrating data over SMTP.

Affected Systems

• Windows endpoints (enterprise and individual users)
• macOS systems
• Users downloading cracked/keygen software
• Email users receiving spear-phishing attachments

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Victims download cracked software/keygens from SEO-poisoned search results or receive phishing emails with compressed executable attachments
2. Execution: EXE payload runs directly (~84.5% of cases) or a legitimate application side-loads a malicious DLL such as python37.dll or LcMgr.dll (~15.5% of cases)
3. macOS Execution: Users are socially engineered via ClickFix to paste and run malicious commands in Terminal, or download malicious Bash scripts
4. C2 Communication: macOS variant dynamically resolves C2 server address by querying Polygon blockchain smart contract data
5. Persistence: macOS variant creates a .plist file to establish a LaunchAgent for persistence
6. Exfiltration/Impact: Stolen credentials and information are exfiltrated (via SMTP in email-based campaigns) for resale on the dark web or use in secondary attacks

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not provide any YARA, Sigma, Suricata/Snort, or query-language detection rules. It provides a small set of MD5 hashes and FQDNs as IOCs for reference.

Detection Engineering Assessment

Required Log Sources

• Process creation/execution logs (Windows Event ID 4688 or EDR telemetry)
• DLL/module load events
• DNS query logs
• Proxy/web traffic logs for downloads from file-sharing sites
• macOS unified logs / LaunchAgent plist creation events
• Email gateway logs for attachment and SMTP traffic analysis

Hunting Hypotheses

Control Gaps

• Traditional signature-based antivirus may miss frequently repacked/obfuscated infostealer samples
• Standard network security tools may not flag blockchain smart contract queries as malicious C2 traffic
• Email attachment sandboxing may not detect all compressed executable payloads if evasion techniques are used
• Users running unsigned/cracked software bypass application allowlisting and code-signing protections

Key Behavioral Indicators

• Execution of an EXE downloaded from a cloud storage share link shortly after visiting a crack/keygen-related search result
• Legitimate-looking DLL (e.g., named after common runtime libraries) loaded from an atypical application directory
• Creation of a new .plist file under a macOS user LaunchAgents directory correlated with recent Terminal command execution
• Outbound network connections to blockchain node/RPC infrastructure from processes not associated with cryptocurrency wallets or development tools
• SMTP traffic originating from an endpoint shortly after opening an email attachment

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate application allowlisting/whitelisting policies to reduce execution of unauthorized or unsigned EXE/DLL files.
• Consider restricting or monitoring outbound access to consumer cloud storage services (Mediafire, Mega) where not required for business use.
• Evaluate DNS filtering/blocking capabilities against known malicious FQDNs and consider monitoring for unusual blockchain RPC traffic from non-standard processes.
• Consider enforcing code-signing verification for DLLs loaded by critical applications to reduce side-loading risk.

User Protection

• Consider deploying endpoint protection with behavioral detection capable of identifying DLL side-loading and unauthorized LaunchAgent creation on macOS.
• Where applicable, consider disabling or restricting the ability of standard users to paste and execute arbitrary Terminal commands without review.
• Evaluate email security controls for stripping or sandboxing compressed executable attachments.
• Encourage use of two-factor authentication (2FA) and periodic password changes on accounts that may be affected by stolen credentials.

Security Awareness

• Consider incorporating guidance against downloading cracked software, keygens, or illegal software into existing security awareness training.
• Educate users on the ClickFix social engineering technique, specifically the risk of copying and pasting commands into Terminal or Run dialogs from untrusted sources.
• Reinforce caution with email attachments and links, particularly compressed files from unfamiliar senders impersonating known companies.
• Promote encryption of sensitive documents and mindful use of browser-stored credentials as part of general security hygiene training.

MITRE ATT&CK Mapping

Additional IOCs

• File Paths:
  • python37.dll - Malicious DLL used for DLL side-loading, disguised as a legitimate Python runtime library
  • LcMgr.dll - Malicious DLL used for DLL side-loading in June 2026 infostealer campaigns
  • python315.dll - Malicious DLL used for DLL side-loading, disguised as a legitimate Python runtime library
• Command Lines:
  • Purpose: ClickFix social engineering technique tricking macOS users into copying and executing a malicious command in Terminal | Tools: Terminal, Bash | Stage: Initial Access / Execution