Acreed
Acreed is an information-stealing malware family that gained rapid traction among cybercriminals in 2025. It is described as an infostealer and, in one source, as a newly discovered spyware toolkit spreading at a high rate over the internet. Reporting states it was first advertised on Russian Market in February 2025 by a user named "Nu####ez" and is assessed to be a private project. Multiple sources indicate Acreed quickly rose to prominence in the infostealer ecosystem: by Q1 2025 it had surpassed many established stealers, ranked second only to Lumma in some reporting, and was listed among the top infostealers alongside Lumma, Rhadamanthys, Vidar, and StealC. Flashpoint reported Acreed was among the top five infostealers by infected hosts in 2025, and other reporting described it as the third most prevalent infostealer, with links to Vidar. The provided content does not include specific technical details on Acreed’s internal functionality, infection chain, targeted sectors, or concrete indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Credential Access
3 techniques
Credential Access
“...test stolen credentials across multiple services, and adjust tactics based on failed attempts without human input.” / “stolen credentials could be tested against thousands of endpoints simultaneously, including corporate VPNs, SaaS providers, and cloud services…”
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer listed among the most active by infected hosts in 2025.
A newly discovered spyware toolkit that spreads rapidly via emails disguised as genuine messages or software updates, silently installing itself on compromised machines.
Information stealer malware gaining popularity in 2025, used to collect credentials and sensitive data.
An information stealer mentioned as a more recent MaaS stealer in the same ecosystem as Rhadamanthys.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.