hacker-news · Crawled Jul 17, 2026

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

67 IoCs 1 Malware
Read original article ↗

AI Summary

ACR Stealer, an infostealer active since 2024, is being distributed through social engineering lures such as fake Claude AI assistant pages and malvertising. The malware uses fileless techniques and WebDAV shares to steal browser credentials, session tokens, and sensitive files from Microsoft 365, OneDrive, and SharePoint. It relies on user execution via pasted commands and does not exploit software vulnerabilities, making detection dependent on behavioral analysis and proactive controls.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware ACR Stealer →

Indicators of Compromise 67 extracted

Type Value Detail
Domain creativecommunityinfo[[.]]art Details →
Domain enhanceblabber[[.]]cc Details →
Domain sphere-api[.]dialectosphere[.]in[[.]]net Details →
IP 185[.]153[.]47[.]197 Details →
IP 185[.]153[.]47[.]198 Details →
IP 185[.]153[.]47[.]199 Details →
IP 185[.]153[.]47[.]200 Details →
IP 185[.]153[.]47[.]201 Details →
IP 185[.]153[.]47[.]202 Details →
IP 185[.]153[.]47[.]203 Details →
IP 185[.]153[.]47[.]204 Details →
IP 185[.]153[.]47[.]205 Details →
IP 185[.]153[.]47[.]206 Details →
IP 185[.]153[.]47[.]207 Details →
IP 185[.]153[.]47[.]208 Details →
IP 185[.]153[.]47[.]209 Details →
IP 185[.]153[.]47[.]210 Details →
IP 185[.]153[.]47[.]211 Details →
IP 185[.]153[.]47[.]212 Details →
IP 185[.]153[.]47[.]213 Details →
IP 185[.]153[.]47[.]214 Details →
IP 185[.]153[.]47[.]215 Details →
IP 185[.]153[.]47[.]216 Details →
IP 185[.]153[.]47[.]217 Details →
IP 185[.]153[.]47[.]218 Details →
IP 185[.]153[.]47[.]219 Details →
IP 185[.]153[.]47[.]220 Details →
IP 185[.]153[.]47[.]221 Details →
IP 185[.]153[.]47[.]222 Details →
IP 185[.]153[.]47[.]223 Details →
IP 185[.]153[.]47[.]224 Details →
IP 185[.]153[.]47[.]225 Details →
IP 185[.]153[.]47[.]226 Details →
IP 185[.]153[.]47[.]227 Details →
IP 185[.]153[.]47[.]228 Details →
IP 185[.]153[.]47[.]229 Details →
IP 185[.]153[.]47[.]230 Details →
IP 185[.]153[.]47[.]231 Details →
IP 185[.]153[.]47[.]232 Details →
IP 185[.]153[.]47[.]233 Details →
IP 185[.]153[.]47[.]234 Details →
IP 185[.]153[.]47[.]235 Details →
IP 185[.]153[.]47[.]236 Details →
IP 185[.]153[.]47[.]237 Details →
IP 185[.]153[.]47[.]238 Details →
IP 185[.]153[.]47[.]239 Details →
IP 185[.]153[.]47[.]240 Details →
IP 185[.]153[.]47[.]241 Details →
IP 185[.]153[.]47[.]242 Details →
IP 185[.]153[.]47[.]243 Details →
IP 185[.]153[.]47[.]244 Details →
IP 185[.]153[.]47[.]245 Details →
IP 185[.]153[.]47[.]246 Details →
IP 185[.]153[.]47[.]247 Details →
IP 185[.]153[.]47[.]248 Details →
IP 185[.]153[.]47[.]249 Details →
IP 185[.]153[.]47[.]250 Details →
IP 185[.]153[.]47[.]251 Details →
IP 185[.]153[.]47[.]252 Details →
IP 185[.]153[.]47[.]253 Details →
IP 185[.]153[.]47[.]254 Details →
IP 185[.]153[.]47[.]255 Details →
Filename google.ct Details →
Filename LogiOptionsPlus Details →
Filename ck-3d80df5d12cdfe6450a782fc87bf66b444.google Details →
SHA-256 3d80df5d12cdfe6450a782fc87bf66b444b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4 Details →
GitHub Repo claude-desktop.gitlab.io Details →

MITRE ATT&CK TTPs 14 techniques

T1021.002 SMB/Windows Admin Shares · Lateral Movement T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1070.005 Network Share Connection Removal · Defense Evasion T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1085 T1085 T1105 Ingress Tool Transfer · Command And Control T1112 Modify Registry · Defense Evasion T1482 Domain Trust Discovery · Discovery T1485 Data Destruction · Impact