Back Cybersecuritynews

New ACRStealer Variant Uses Syscall Evasion, TLS C2 and Secondary Payload Delivery

Cybersecuritynews •Tushar Subhra Dutta • March 16, 2026

A new variant of ACRStealer has emerged with upgraded capabilities that make it significantly harder to detect and more dangerous to the systems it targets. First reported by Proofpoint in early 2025 as a rebranded version of the Amatera Stealer, this latest iteration introduces low-level syscall evasion, encrypted C2 communication over TLS, and the ability […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New ACRStealer Variant Enhances Evasion Techniques and Threat Level A newly identified variant of ACRStealer is actively being deployed by HijackLoader, utilizing advanced techniques to evade detection and maximize data theft. This variant employs low-level syscall evasion, AFD-based networking, and encrypted TLS communication for command and control (C2). It is a rebranded version of a previously known ACRStealer variant linked to the Amatera Stealer. The attack method allows for flexible secondary payload delivery, increasing its effectiveness against targeted systems. As of March 16, 2026, the threat remains active, with ongoing concerns about its impact on various organizations. Specific numbers of affected systems or data breaches have not been disclosed in the articles. Security professionals are urged to remain vigilant against this evolving threat. 2 sources 65

Extracted Entities

New ACRStealer Variant Uses Syscall Evasion, TLS C2 and Secondary Payload Delivery

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)