Malware

ACR Stealer

First introduced in March 2024, ACR Stealer is an information stealer sold as a Malware-as-a-Service (MaaS) on Russian-speaking cybercrime forums by a threat actor named "SheldIO". Researchers posit that this malware is an evolved version of the GrMsk Stealer, which likely aligns with the private stealer that SheldIO has been selling since July 2023. The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs. Additionally, it employs the dead drop resolver (DDR) technique to obfuscate the actual C2 infrastructure.

Indicators of Compromise 68

Domain creativecommunityinfo[[.]]art Domain enhanceblabber[[.]]cc Domain google[.]ct Domain sphere-api[.]dialectosphere[.]in[[.]]net Filename LogiOptionsPlus Filename ck-3d80df5d12cdfe6450a782fc87bf66b444.google Filename google.ct GitHub Repo claude-desktop.gitlab.io SHA-256 3d80df5d12cdfe6450a782fc87bf66b444b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4 IP 185[.]153[.]47[.]197 IP 185[.]153[.]47[.]198 IP 185[.]153[.]47[.]199 IP 185[.]153[.]47[.]200 IP 185[.]153[.]47[.]201 IP 185[.]153[.]47[.]202 IP 185[.]153[.]47[.]203 IP 185[.]153[.]47[.]204 IP 185[.]153[.]47[.]205 IP 185[.]153[.]47[.]206 IP 185[.]153[.]47[.]207 IP 185[.]153[.]47[.]208 IP 185[.]153[.]47[.]209 IP 185[.]153[.]47[.]210 IP 185[.]153[.]47[.]211 IP 185[.]153[.]47[.]212 IP 185[.]153[.]47[.]213 IP 185[.]153[.]47[.]214 IP 185[.]153[.]47[.]215 IP 185[.]153[.]47[.]216 IP 185[.]153[.]47[.]217 IP 185[.]153[.]47[.]218 IP 185[.]153[.]47[.]219 IP 185[.]153[.]47[.]220 IP 185[.]153[.]47[.]221 IP 185[.]153[.]47[.]222 IP 185[.]153[.]47[.]223 IP 185[.]153[.]47[.]224 IP 185[.]153[.]47[.]225 IP 185[.]153[.]47[.]226 IP 185[.]153[.]47[.]227 IP 185[.]153[.]47[.]228 IP 185[.]153[.]47[.]229 IP 185[.]153[.]47[.]230 IP 185[.]153[.]47[.]231 IP 185[.]153[.]47[.]232 IP 185[.]153[.]47[.]233 IP 185[.]153[.]47[.]234 IP 185[.]153[.]47[.]235 IP 185[.]153[.]47[.]236 IP 185[.]153[.]47[.]237 IP 185[.]153[.]47[.]238 IP 185[.]153[.]47[.]239 IP 185[.]153[.]47[.]240 IP 185[.]153[.]47[.]241 IP 185[.]153[.]47[.]242 IP 185[.]153[.]47[.]243 IP 185[.]153[.]47[.]244 IP 185[.]153[.]47[.]245 IP 185[.]153[.]47[.]246 IP 185[.]153[.]47[.]247 IP 185[.]153[.]47[.]248 IP 185[.]153[.]47[.]249 IP 185[.]153[.]47[.]250 IP 185[.]153[.]47[.]251 IP 185[.]153[.]47[.]252 IP 185[.]153[.]47[.]253 IP 185[.]153[.]47[.]254 IP 185[.]153[.]47[.]255

MITRE ATT&CK TTPs 14

SMB/Windows Admin Shares

Lateral Movement

Match Legitimate Name or Location

Defense Evasion

Process Injection

Defense Evasion

Windows Command Shell

Network Share Connection Removal

Defense Evasion

Command And Control

System Information Discovery

Ingress Tool Transfer

Command And Control

Modify Registry

Defense Evasion

Domain Trust Discovery

Data Destruction

Source Articles

Microsoft warns of surge in ACR Stealer attacks on customers

Microsoft has observed a significant increase in ACR Stealer malware attacks targeting enterprise customers. The malware is delivered via social engineering using the ClickFix lure, WebDAV servers, and MSHTA to execute malicious payloads. ACR Stealer steals browser passwords, authentication tokens, and sensitive documents, leveraging obfuscated PowerShell scripts, in-memory execution, and steganographic images. Some variants use blockchain services as dead-drop resolvers for C2 communication.

bleeping-computer ·1w ago

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an infostealer active since 2024, is being distributed through social engineering lures such as fake Claude AI assistant pages and malvertising. The malware uses fileless techniques and WebDAV shares to steal browser credentials, session tokens, and sensitive files from Microsoft 365, OneDrive, and SharePoint. It relies on user execution via pasted commands and does not exploit software vulnerabilities, making detection dependent on behavioral analysis and proactive controls.

hacker-news ·1w ago