{
  "name": "ACR Stealer: Two observed intrusion chains amid increased threat activity",
  "slug": "acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity",
  "description": "Between late April and mid-June 2026, Microsoft observed heightened ACR Stealer activity targeting enterprise environments through ClickFix social engineering lures. This information-stealing malware, associated with Amatera Stealer rebranding and offered as malware-as-a-service, deployed through two distinct campaigns. The first utilized WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control resolution. The second employed a fileless approach using MSHTA and steganography-concealed payloads within images. Both campaigns harvested browser credentials, authentication tokens, and sensitive documents from compromised systems. Threat actors leveraged obfuscated PowerShell scripts, scheduled task persistence, and in-memory execution techniques to evade detection. Notable tactics included masquerading as legitimate software updates, utilizing Windows DPAPI for credential decryption, and targeting PDF and Microsoft 365 documents. The blockchain dead-drop technique enabled dynamic i...",
  "published": "2026-07-17T01:19:38.735000+00:00",
  "created_at": "2026-07-17T10:46:34.964000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-17T10:46:34.964000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "acr stealer",
    "amatera stealer",
    "blockchain c2",
    "clickfix",
    "steganography",
    "webdav"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "4e25e4fd-d744-4827-a182-33730d3507e9",
        "name": "contrite.quirksturdy.icu"
      },
      {
        "id": "4e0fd67b-fd25-4f85-9c94-a7c18b81a358",
        "name": "deep-harborio.com"
      },
      {
        "id": "4cd10580-8512-4da1-b686-06de92ed8b54",
        "name": "proton-network.com"
      },
      {
        "id": "2a9fbcf5-c745-45b0-8bbd-5c1b89e7f498",
        "name": "looksta.icu"
      },
      {
        "id": "a46e3876-169b-4750-b85c-0a14c46af855",
        "name": "apigrokcloud.icu"
      },
      {
        "id": "c170f6a1-9430-4d36-b384-5cc7fd9e7802",
        "name": "prism-matrixs.com"
      },
      {
        "id": "46bcea82-60e7-49b9-aa80-b5eeca7c610c",
        "name": "creativecommunityinfo.art"
      },
      {
        "id": "2522ddc5-b60c-4701-8b97-1fc96653f093",
        "name": "enhanceblabber.cc"
      },
      {
        "id": "70519636-2fae-408a-a075-240f0037117a",
        "name": "auramatrixa.com"
      },
      {
        "id": "cd61f6d3-3fda-4e95-8906-5c5568fd9d9d",
        "name": "zealpraxis.com"
      },
      {
        "id": "b1b555f8-def7-483b-8f1a-d38d7bf1aaf3",
        "name": "breaksd.wifihot.icu"
      },
      {
        "id": "4764311b-9811-40ba-ac9a-10bd48102792",
        "name": "cpppemwjewjoiwejow.sale"
      },
      {
        "id": "e2089c45-821a-4149-a3b3-687ef6d7995b",
        "name": "fast.raidher.icu"
      },
      {
        "id": "9745d114-eace-4e09-adcd-146be738e6ac",
        "name": "walter.filloco.icu"
      },
      {
        "id": "0f993cb1-94c5-41a2-820a-fc372b21444c",
        "name": "ux.strainedeasily.icu"
      },
      {
        "id": "4e5699cd-9d22-437f-ba99-a8d3ebaa8f61",
        "name": "prism-vertex.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "ab1a2f00-2489-4c89-af29-e767f5fa5a23",
        "name": "T1070.003"
      },
      {
        "id": "d3254e3b-07e6-4420-96e0-2e107ce17712",
        "name": "T1102.001"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "741a926d-4157-412c-9296-f701c8dbd56d",
        "name": "T1027.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "eaed9e28-8072-48ff-bd94-ed7d72554636",
        "name": "T1218.005"
      },
      {
        "id": "81b422de-709e-43bd-b471-2befac0c623a",
        "name": "T1218.011"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "1e73eaa9-ea78-444b-b3a3-5842f5d35115",
        "name": "T1074"
      }
    ],
    "malware": [
      {
        "id": "b732c72d-6b65-4bd1-ade4-2709a317deed",
        "name": "ACR Stealer",
        "slug": "acr-stealer"
      },
      {
        "id": "0f06cc03-e80e-4d0b-9085-860608b16f21",
        "name": "Amatera Stealer",
        "slug": "amatera-stealer"
      }
    ],
    "observables": [
      {
        "id": "99d297f7-c01a-4067-8050-764bb6721b1c",
        "name": "deep-harborio.com"
      },
      {
        "id": "6a6bd97f-21bd-4eab-9ba6-8eb50846244b",
        "name": "prism-matrixs.com"
      },
      {
        "id": "78d77a74-29b1-4ce0-9e45-01f666b6f36c",
        "name": "creativecommunityinfo.art"
      },
      {
        "id": "0815a31b-0c29-429f-be64-6fc0270dafa2",
        "name": "enhanceblabber.cc"
      },
      {
        "id": "5a1334a2-6580-4316-b801-0371a0a29b77",
        "name": "apigrokcloud.icu"
      },
      {
        "id": "4e09f9df-4061-4174-8c4c-375cd7a50664",
        "name": "looksta.icu"
      },
      {
        "id": "5ffe5e20-8637-41d9-be31-dd5705ca41d0",
        "name": "auramatrixa.com"
      },
      {
        "id": "76e05c41-3c69-409c-9fde-77d8c2cc808c",
        "name": "zealpraxis.com"
      },
      {
        "id": "9dd889b4-c3de-4f86-b23b-181b993a490e",
        "name": "prism-vertex.com"
      },
      {
        "id": "dd3408c1-73bb-471e-afeb-0f3205992625",
        "name": "cpppemwjewjoiwejow.sale"
      },
      {
        "id": "f72a4606-ee05-41cf-aa96-d5123b42e9ac",
        "name": "proton-network.com"
      },
      {
        "id": "ccd8817b-ef12-470c-b89c-836f6db9a158",
        "name": "walter.filloco.icu"
      },
      {
        "id": "ac99eaae-3e38-4ff0-b74f-959e14ca9c08",
        "name": "breaksd.wifihot.icu"
      },
      {
        "id": "9efcc00a-3461-4426-b710-b47570aaff90",
        "name": "contrite.quirksturdy.icu"
      },
      {
        "id": "7852caaf-26d6-41c8-b948-1e4594cd3d5f",
        "name": "ux.strainedeasily.icu"
      },
      {
        "id": "5375f622-a64e-4278-9bf4-343219c88ce2",
        "name": "fast.raidher.icu"
      }
    ]
  },
  "external_refs": [
    {
      "id": "8f47c354-47a5-45ea-9299-360d725bad69",
      "standard_id": "external-reference--6b055681-8350-5156-89d2-760be77f503a",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a59832ac2ebd9e525a462b9",
      "hash": null,
      "external_id": "6a59832ac2ebd9e525a462b9",
      "created": "2026-07-17T10:46:33.252Z",
      "modified": "2026-07-17T10:46:33.252Z",
      "createdById": null
    },
    {
      "id": "56e01e17-55f1-4401-950e-aa065ad4ed28",
      "standard_id": "external-reference--8c879668-bc91-5d9d-a0f1-dd1a6c548837",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-17T10:46:33.309Z",
      "modified": "2026-07-17T10:46:33.309Z",
      "createdById": null
    }
  ]
}