Back Gbhackers

ACRStealer Variant Deploys Syscall Evasion, TLS C2, Secondary Payloads

Gbhackers •Mayura Kathir • March 16, 2026

New research reveals that a new ACRStealer variant is now being actively deployed as a final payload by HijackLoader, using low‑level syscalls, AFD-based networking, TLS C2, and flexible secondary payload delivery to evade detection and maximize data theft. The newly observed samples confirm that HijackLoader is dropping a rebranded ACRStealer variant previously linked to the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New ACRStealer Variant Enhances Evasion Techniques and Threat Level A newly identified variant of ACRStealer is actively being deployed by HijackLoader, utilizing advanced techniques to evade detection and maximize data theft. This variant employs low-level syscall evasion, AFD-based networking, and encrypted TLS communication for command and control (C2). It is a rebranded version of a previously known ACRStealer variant linked to the Amatera Stealer. The attack method allows for flexible secondary payload delivery, increasing its effectiveness against targeted systems. As of March 16, 2026, the threat remains active, with ongoing concerns about its impact on various organizations. Specific numbers of affected systems or data breaches have not been disclosed in the articles. Security professionals are urged to remain vigilant against this evolving threat. 2 sources 65

Extracted Entities

ACRStealer Variant Deploys Syscall Evasion, TLS C2, Secondary Payloads

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)