Acreed

Acreed is a Windows-focused infostealer that emerged in early 2025 and rapidly became one of the most prevalent stealer services in the cybercrime ecosystem. It is commonly discussed alongside major malware-as-a-service infostealers such as Lumma, Rhadamanthys, Vidar, and StealC, and has been assessed as a private project advertised in Russian-speaking criminal markets. By 2025 it had risen to the top tier of active infostealer operations by infected hosts and stolen-log volume.

Acreed’s core function is credential and data theft from compromised endpoints. Infostealers in this class are used to harvest browser-saved credentials, autofill data, active session cookies, authentication tokens, SSH keys, local configuration data, and cryptocurrency wallet information, packaging the results into structured stealer logs for resale and follow-on intrusion activity. The operational value of such malware extends beyond password theft because stolen session material can enable account takeover and downstream compromise of cloud services, developer platforms, source-code repositories, CI/CD environments, and other enterprise resources.

Observed infection patterns indicate broad, opportunistic victimization rather than tightly preselected targeting. Common delivery mechanisms associated with contemporary infostealer activity include trojanized software, malvertising, and fraudulent CAPTCHA or ClickFix-style social-engineering pages that induce users to execute malicious commands or payloads. Acreed has also been linked in reporting to Vidar, but the precise nature of that relationship is not currently available at high confidence.

Acreed has been observed in the wider criminal market for stealer logs, where harvested data is traded and filtered for later exploitation by other actors, including initial access brokers. Its rise after disruptions to competing services underscores the resilience and substitutability of the infostealer ecosystem. The malware represents a significant supply-chain and identity risk because infections on developer and knowledge-worker systems can expose both personal and corporate credentials, active sessions, and connected service tokens from a single compromised device.