ACRStealer Variant Deploys Syscall Evasion, TLS C2, Secondary Payloads

New research identifies an actively maintained, rebranded ACRStealer variant used as a final payload by HijackLoader and distributed via the PiviGames ecosystem; the malware employs low-level NTDLL/WoW64 syscalls and AFD-based sockets to evade API/EDR hooks, upgrades TCP to TLS via SSPI, bypasses DPAPI/Chrome protections to steal browser and Steam credentials, supports process hollowing and PowerShell-based secondary payloads, and exfiltrates staged data to infrastructure including IP 157.180.40.106 and playtogga.com with telemetry across the USA, Mongolia, and Germany.