{
  "Event": {
    "analysis": "1",
    "date": "2026-07-16",
    "extends_uuid": "",
    "info": "[Threat Intel] ACR Stealer: Two observed intrusion chains amid increased threat activity",
    "protected": false,
    "publish_timestamp": "1785033898",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1785033898",
    "uuid": "d013d148-9c8f-4db8-9de8-a810f0f8d4de",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#177fb7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"",
        "relationship_type": ""
      },
      {
        "colour": "#fa3e60",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clear Command History - T1070.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#68f2ff",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ed4a7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#aa1f95",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Staged - T1074\"",
        "relationship_type": ""
      },
      {
        "colour": "#9e0269",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "relationship_type": ""
      },
      {
        "colour": "#30f613",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Mshta - T1218.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#3780c6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"",
        "relationship_type": ""
      },
      {
        "colour": "#755c09",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#e2a873",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steganography - T1027.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d37d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#02475d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"",
        "relationship_type": ""
      },
      {
        "colour": "#8d021b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"ACR Stealer\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Amatera\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Latrodectus\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343652",
        "to_ids": false,
        "type": "link",
        "uuid": "7a177237-0a3f-4afe-b905-f6d55bdc1f21",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343652",
        "to_ids": false,
        "type": "text",
        "uuid": "6f1af977-bc98-4583-b909-fb5b9a5e2992",
        "value": "Between late April and mid-June 2026, Microsoft observed heightened ACR Stealer activity targeting enterprise environments through ClickFix social engineering lures. This information-stealing malware, associated with Amatera Stealer rebranding and offered as malware-as-a-service, deployed through two distinct campaigns. The first utilized WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control resolution. The second employed a fileless approach using MSHTA and steganography-concealed payloads within images. Both campaigns harvested browser credentials, authentication tokens, and sensitive documents from compromised systems. Threat actors leveraged obfuscated PowerShell scripts, scheduled task persistence, and in-memory execution techniques to evade detection. Notable tactics included masquerading as legitimate software updates, utilizing Windows DPAPI for credential decryption, and targeting PDF and Microsoft 365 documents. The blockchain dead-drop technique enabled dynamic i..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343652",
        "to_ids": false,
        "type": "text",
        "uuid": "b739f31b-911d-4814-a5b2-49ef24265fcc",
        "value": "Name: ACR Stealer: Two observed intrusion chains amid increased threat activity\nAuthor: AlienVault\nAdversary: \nTags: [\"blockchain c2\", \"webdav\", \"steganography\", \"amatera stealer\", \"clickfix\", \"acr stealer\"]\nTgtd countries: []\nMlwr families: [\"ACR Stealer\", \"Amatera Stealer\"]\nAttack_ids: [\"T1053.005\", \"T1218.011\", \"T1070.003\", \"T1005\", \"T1036\", \"T1055\", \"T1555.003\", \"T1074\", \"T1102\", \"T1218.005\", \"T1204\", \"T1059.001\", \"T1027\", \"T1027.003\", \"T1059.006\", \"T1059.003\", \"T1189\", \"T1102.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "1st Stage payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899725",
        "to_ids": true,
        "type": "domain",
        "uuid": "3097fa77-4721-4953-8f30-48c89e3bc3bc",
        "value": "proton-network.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899747",
        "to_ids": true,
        "type": "hostname",
        "uuid": "8bc3eaf9-f03b-4fdd-af0b-18f73d36a116",
        "value": "ux.strainedeasily.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899768",
        "to_ids": true,
        "type": "domain",
        "uuid": "b1166cf8-62ab-4bd4-b34e-096d3de2665d",
        "value": "looksta.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899790",
        "to_ids": true,
        "type": "hostname",
        "uuid": "c0a0ce3b-aa23-4f16-9cd2-9e07c5f65fae",
        "value": "fast.raidher.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899811",
        "to_ids": true,
        "type": "domain",
        "uuid": "cff1d32e-d3bb-4ff8-8d93-b51b0a90ef46",
        "value": "apigrokcloud.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "1st Stage payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899832",
        "to_ids": true,
        "type": "domain",
        "uuid": "d5d20efd-5b7e-483a-a54b-76323ee07330",
        "value": "deep-harborio.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "1st Stage payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899853",
        "to_ids": true,
        "type": "domain",
        "uuid": "e05f087d-fd3e-418f-8c86-2b7727913357",
        "value": "zealpraxis.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "1st Stage payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899875",
        "to_ids": true,
        "type": "domain",
        "uuid": "bcea76fd-5b0b-46d2-b22b-2d13a75b9061",
        "value": "prism-vertex.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "1st Stage payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899896",
        "to_ids": true,
        "type": "domain",
        "uuid": "ad31ad46-c06a-4657-be8a-ea76160a15de",
        "value": "auramatrixa.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899917",
        "to_ids": true,
        "type": "domain",
        "uuid": "7c69b0cd-c4f5-4014-9720-e9ffaa3ddc57",
        "value": "cpppemwjewjoiwejow.sale",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899938",
        "to_ids": true,
        "type": "domain",
        "uuid": "9da60f23-7dc0-4030-a0e6-06d5c63947b8",
        "value": "creativecommunityinfo.art",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899960",
        "to_ids": true,
        "type": "domain",
        "uuid": "6d9bcb7d-25ba-4ece-9dbb-bf2f4afd2e50",
        "value": "enhanceblabber.cc",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "1st Stage payload hosting site",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784899981",
        "to_ids": true,
        "type": "domain",
        "uuid": "4de6febf-f7f9-485f-94dd-2b46085d3b43",
        "value": "prism-matrixs.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784900002",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5c4d5961-d2e3-46db-ad9e-40ed918f2406",
        "value": "breaksd.wifihot.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784900024",
        "to_ids": true,
        "type": "hostname",
        "uuid": "9a32535a-6142-42a9-9a3d-314bfe2955d8",
        "value": "contrite.quirksturdy.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "C2 domain",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784900045",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1b6f556e-97b3-4ca1-9d12-a9617d5b563f",
        "value": "walter.filloco.icu",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}