{ "id": "d2a2d332-df9b-48c8-a676-57fe6844cc21", "created_at": "2026-09-08T02:03:35.963754Z", "updated_at": "2026-10-20T09:16:45.699659Z", "deleted_at": null, "sha1_hash": "7c375e86a165f91b5615cf29717bc4a9b7440e4c", "title": "ACR Stealer: Two observed intrusion chains amid increased threat activity", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1439407, "plain_text": "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nACR Stealer: Two observed intrusion chains amid increased threat\n\nactivity\n\nBy Microsoft Security Research, Balaji Venkatesh S\n\nPublished: 2026-07-16 · Archived: 2026-09-08 02:00:53 UTC\n\nFrom late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity\n\nacross customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials,\n\nauthentication tokens, and sensitive documents from enterprise environments. Successful compromise can expose\n\nbrowser credentials, session tokens, authentication artifacts, and sensitive enterprise data, potentially enabling\n\naccount compromise, unauthorized access to cloud resources, and follow-on intrusion activity. Security teams\n\nshould prioritize monitoring for ClickFix lures, suspicious WebDAV activity, obfuscated PowerShell execution,\n\nand attempts to access browser credential stores.\n\nACR Stealer is an information-stealing malware family reportedly offered through a malware-as-a-service (MaaS)\n\nmodel and associated with the rebranding of Amatera Stealer. During this period, two campaigns stand out,\n\ntogether appearing frequently in reviewed recent intrusions. Both begin the same way, with a ClickFix social\n\nengineering technique that tricks targets into running the threat actor’s command, but the intrusion chains that\n\nfollow diverge in how they deliver payloads, establish execution, and evade detection.\n\nThe first campaign relies on WebDAV-delivered payloads, staged PowerShell, Python-based loaders and\n\npersistence, and, in some intrusions, blockchain-backed dead-drop command-and-control (C2) resolution. The\n\nsecond campaign takes a more fileless route, using MSHTA, obfuscated PowerShell, and steganography-assisted\n\nin-memory execution. Despite these differences, both campaigns ultimately pursue the same goal: stealing\n\nbrowser-stored credentials and other sensitive data for exfiltration.\n\nThese two campaigns represent some of the most prevalent ACR Stealer delivery campaigns observed by\n\nDefender Experts; however, they do not represent the full range of delivery methods used by this malware family.\n\nAttribution to ACR Stealer is based on the observed behavior and post-exploitation tradecraft, corroborated by\n\nopen-source intelligence on the infrastructure associated with this malware family. Additional campaigns,\n\ninfrastructure patterns, and execution chains are likely active, and organizations should treat the indicators and\n\ntechniques described here as representative.\n\nMicrosoft Defender for Endpoint can help surface both campaigns through behavioral coverage for living-off-the-\n\nland execution, suspicious WebDAV and MSHTA activity, obfuscated PowerShell, scheduled-task persistence, in-\n\nmemory payload execution, and browser credential theft. In this blog, we analyze both campaigns in detail,\n\nincluding their delivery mechanisms, post-exploitation tradecraft, indicators of compromise, hunting\n\nopportunities, and guidance to help defenders detect and disrupt related activity in their environments.\n\nPage 1 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nCampaign 1: WebDAV-based ClickFix with Python loaders and blockchain C2\n\nInitial access\n\nIn this campaign, a ClickFix prompt, likely delivered through malvertising or SEO-manipulated search results,\n\ninstructs the target user to run a command that launches cmd.exe. The command subsequently invokes\n\nrundll32.exe to load a DLL from a remote WebDAV share accessed over HTTPS. The WebDAV path commonly\n\nuses a GUID-based directory structure and filenames designed to resemble legitimate resources (for example,\n\ngoogle.ct), enabling the activity to blend with expected network traffic and evade casual inspection.\n\nWe observed three variants of the initial execution command:\n\nVariant 1: Direct rundll32 invocation\n\nVariant 2: pushd-Mounted WebDAV Share\n\nVariant 3: Headless and obfuscated pushd execution\n\nVariants 2 and 3 are notable for their use of pushd, which transparently maps the remote WebDAV share to a\n\ntemporary local drive prior to execution. This technique allows threat actors to execute remotely hosted content\n\nthrough what appears to be a local path, simplifying payload execution while reducing user awareness. In the\n\nmore advanced variant, threat actors further enhance stealth by launching commands through conhost.exe\n\n–headless, suppressing visible console windows, and employing environment variable obfuscation with delayed\n\nvariable expansion to conceal critical execution components such as pushd, rundll32, and the remote host name.\n\nCombined with minimized or headless execution, these techniques reduce user visibility, complicate static\n\nanalysis and detection, and enable the infection chain to execute with minimal indication to the victim.\n\nPage 2 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nExecution, persistence, and evasion through process masquerading\n\nOnce rundll32.exe loads the DLL retrieved from the remote server, the malware establishes communication with\n\nthreat actor-controlled infrastructure and executes a heavily obfuscated PowerShell script. The script employs\n\nexcessive arithmetic no-ops, dead loops, fake control flow, and randomized variable names to hinder static\n\nanalysis and evade signature-based detection.\n\nThe PowerShell script subsequently deploys another stage that functions as both a malware installer and a\n\npersistence mechanism. It:\n\nDownloads a ZIP-packaged payload from a remote server and extracts it into a deceptive directory under\n\n%LocalAppData%\\Temp (for example, LogiOptionsPlus).\n\nLaunches a Python script using a bundled pythonw.exe instance to avoid displaying a console window.\n\nRemoves previous deployments and terminates running instances before installation, effectively operating\n\nas an updater.\n\nEstablishes persistence through a hidden scheduled task disguised as a legitimate software update, ensuring\n\nexecution at user sign-in.\n\nCopies timestamps from a trusted Windows binary (notepad.exe) to the deployed files and clears\n\nPowerShell command history to reduce forensic visibility.\n\nPage 3 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nPowerShell loader downloads and executes a payload through a masqueraded scheduled task.\n\nPython loader launching the stealer\n\nPage 4 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nThe Python component serves as a heavily obfuscated loader designed to conceal its true functionality until\n\nruntime. It employs multiple layers of defense against static analysis, including dynamic API resolution, encoded\n\nstring reconstruction, junk-data removal, character shifting, string reversal, Base64 decoding, and zlib\n\ndecompression. These techniques ensure that the embedded payload remains unreadable in its static form and is\n\nreconstructed only during execution, significantly hindering signature-based detection and automated analysis.\n\nOnce decoded, the final-stage payload functions as an in-memory shellcode loader. It extracts an archive file\n\nmasquerading as a legitimate application installer, reads a file from the archive, and injects the payload into a\n\nsystem process. The loader allocates executable memory using VirtualAlloc, copies the payload into the allocated\n\nmemory region, and transfers execution through the Windows Fiber API (ConvertThreadToFiber, CreateFiber,\n\nand SwitchToFiber). This technique facilitates stealthy in-memory execution while minimizing artifacts written to\n\ndisk.\n\nDecoded Python shellcode loader using VirtualAlloc and Fiber-based execution.\n\nCredential theft and data staging for exfiltration\n\nThe malware (injected code) aggressively harvests information from browser credential stores. It invokes\n\nWindows Data Protection API (DPAPI) routines to decrypt locally stored browser passwords, cookies, and\n\nauthentication tokens. It also enumerates files across the system, targeting PDFs, Microsoft 365 documents, and\n\ndata stored in enterprise-synchronized directories such as OneDrive and SharePoint. The collected data is\n\nsubsequently archived, indicating preparation for exfiltration.\n\nBlockchain dead-drop C2 resolution\n\nA notable variation in this campaign is the use of blockchain services for C2 resolution, utilizing a technique\n\nknown as EtherHiding. While most intrusions rely on more conventional C2 mechanisms, a subset deploys an\n\nadditional secondary Python loader that leverages blockchain services as dead-drop resolvers. When this loader\n\nexecutes, it has been observed communicating with public blockchain RPC endpoints and third-party Web3 node\n\ninfrastructure, likely querying data stored on a decentralized public ledger to retrieve follow-up payloads or a C2\n\naddress.\n\nPage 5 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nBy externalizing C2 information to the blockchain, operators could dynamically update infrastructure without\n\nmodifying or redeploying the malware, significantly complicating detection and takedown efforts. This behavior\n\nwas observed across both variants of the campaign.\n\nCampaign 2: MSHTA-initiated PowerShell chain with steganographic payload\n\ndelivery\n\nThe second campaign takes a distinctly different approach to both delivery and execution. Where Campaign 1\n\nrelies on disk-based artifacts (Python runtime, scheduled tasks, and masquerading binaries), this campaign\n\nachieves its objectives almost entirely through fileless, in-memory execution, making it harder to detect through\n\nfile-based scanning and forensic analysis.\n\nInitial access through MSHTA and ClickFix\n\nThe execution chain begins when the victim, directed through malvertising or SEO-manipulated search results,\n\nencounters a ClickFix prompt that triggers a command spawning MSHTA to fetch and execute remote HTA\n\ncontent from an threat actor-controlled domain. The embedded VBScript loader abuses COM objects to decode\n\nand execute encoded PowerShell content.\n\nVBScript loader using COM objects to decode and launch a PowerShell payload.\n\nPowerShell downloader and obfuscation\n\nThe decoded PowerShell stage employs obfuscation techniques similar to those seen in Campaign 1: randomized\n\nvariable names, arithmetic no-op operations, dead loops, misleading control flow, and custom encryption routines.\n\nPrior to contacting its next-stage infrastructure, the malware generates a victim-specific identifier and disables\n\ncertificate validation. The retrieved content is executed directly in memory.\n\nSteganography-based payload delivery\n\nA notable technique in this campaign is the use of steganography to conceal malicious content inside a publicly\n\nhosted image. Instead of downloading a secondary script (as in Campaign 1), the malware retrieves a JPEG image\n\nfrom an image-hosting service.\n\nPage 6 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nSteganographic payload extraction from a downloaded image prior to decryption and execution.\n\nAnalysis of the script revealed custom routines that extract an embedded payload from image pixels, decrypt and\n\ndecompress it, and execute it entirely in memory. The payload dynamically resolves APIs such as LoadLibrary,\n\nGetProcAddress, VirtualAlloc, CreateThread, and WaitForSingleObject at runtime to perform reflective shellcode\n\nexecution. By combining steganography with in-memory execution, the malware minimizes on-disk artifacts and\n\ncomplicates both detection and analysis.\n\nCredential theft, data collection, and exfiltration\n\nFollowing execution, the malware accesses credential stores belonging to Chromium-based browsers, including\n\nGoogle Chrome and Microsoft Edge, specifically the Login Data and Web Data databases, alongside Windows\n\nDPAPI decryption activity. This behavior indicates attempts to recover stored browser credentials, session cookies,\n\nauthentication tokens, and other sensitive user information.\n\nThe malware also enumerates and accesses multiple high-value PDF documents across Desktop and Downloads\n\nlocations, suggesting targeted collection of potentially sensitive files. The combination of browser credential\n\nharvesting and systematic document access points to an information-stealing objective focused on staging\n\ncredentials and valuable user data for exfiltration.\n\nMitigation and protection guidance\n\nMicrosoft recommends the following mitigations to reduce the impact of ClickFix lures, script-based\n\npayload delivery, credential theft, and post-compromise activity.\n\nEducate users to recognize ClickFix-style prompts, fake verification checks, and paste-and-run instructions\n\nas malicious, especially when they invoke command interpreters or script hosts such as cmd.exe,\n\nPowerShell, rundll32.exe, or mshta.exe.\n\nReduce exposure to malvertising, SEO poisoning, and other web-based delivery chains by enforcing web\n\nfiltering, blocking low-reputation or newly observed domains, and limiting access to remote content\n\nsources that are not required for business operations.\n\nUse application control and attack surface reduction rules to restrict PowerShell, Python, mshta.exe,\n\nrundll32.exe, and similar tools from launching untrusted or internet-delivered content, particularly from\n\nuser-writable directories such as Downloads, Temp, and %LocalAppData%.\n\nMonitor for suspicious persistence and defense-evasion behavior, including scheduled tasks masquerading\n\nas software updates, timestomping, PowerShell history clearing, and execution chains that progress from\n\nremote content retrieval into PowerShell, Python, or shellcode-loading behavior.\n\nPage 7 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nInvestigate abnormal access to Chromium-based browser databases, DPAPI-related decryption activity,\n\nstaged collection of Microsoft 365 documents or PDFs, and compression activity that may indicate\n\ncredential theft or data staging for exfiltration.\n\nIf compromise is suspected, isolate affected devices, rotate exposed credentials, revoke potentially\n\ncompromised tokens, review persistence mechanisms, and investigate outbound connections to remote\n\nshares, image-hosting services, or other infrastructure used to resolve or retrieve follow-on payloads.\n\nHarden endpoints against credential theft by reducing reliance on browser-stored credentials, enforcing\n\nmultifactor authentication and conditional access, and reviewing how privileged accounts access sensitive\n\napplications and synchronized enterprise data.\n\nTurn on cloud-delivered protection and behavior-based detections to help identify rapidly evolving\n\nthreats, suspicious script execution, in-memory payload delivery, abuse of browser credential stores, and\n\nunusual child-process activity.\n\nRun endpoint detection and response (EDR) in block mode and enable automated investigation and\n\nremediation so post-breach detections are contained, and malicious artifacts can be removed with minimal\n\ndelay.\n\nHarden PowerShell by enforcing appropriate execution policies, turning on script block logging, module\n\nlogging, and transcription, and monitoring this telemetry for signs of malicious script activity.\n\nTurn on tamper protection and prevent local administrators from weakening antivirus protection through\n\nlocal policy or exclusion changes.\n\nMicrosoft Defender XDR detections\n\nMicrosoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR\n\ncoordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to\n\nprovide integrated protection against attacks like the threat discussed in this blog.\n\nTactic Observed Activity Microsoft Defender Coverage\n\nMicrosoft Defender for Endpoint\n\n– Use of living-off-the-land binary to\n\nrun malicious code\n\n– Obfuscated command line was\n– Suspicious MSHTA launch\nlaunched\nthrough ClickFix execution\n– Suspicious process executed\n– Rundll32 loads remote\nExecution\nPowerShell command\nWebDAV DLL\n– Suspicious process launch by\n– COM objects launch in-\nRundll32.exe\nmemory PowerShell\n\nMicrosoft Defender for Antivirus\n\nBehavior:Win32/Interhta.Int\n\nPersistence PowerShell creates Scheduled Microsoft Defender for Endpoint\n\ntask, masquerading as a – Suspicious Scheduled Task Process\n\nPage 8 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nsoftware update\n\n– Fiber-API in-memory\n\nStealth/Defense shellcode execution\n\nEvasion – Reflective shellcode via\n\nCreateThread\n\nCollects browser credentials,\n\nCredential cookies, and tokens while\n\nAccess enumerating files for\n\nexfiltration\n\nMicrosoft Security Copilot\n\nMicrosoft Security Copilot is embedded in Microsoft Defender and provides security teams with\n\ncapabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, and\n\ngenerate device summaries, hunting queries, and incident reports.\n\nCustomers can also deploy AI agents, including the following Microsoft Security Copilot agents, to perform\n\nsecurity tasks efficiently:\n\nThreat Intelligence Briefing agent\n\nPhishing Triage agent\n\nThreat Hunting agent\n\nDynamic Threat Detection agent\n\nSecurity Copilot is also available as a standalone experience where customers can perform specific security-\n\nrelated tasks, such as incident investigation, user analysis, and vulnerability impact assessment. In addition,\n\nSecurity Copilot offers developer scenarios that allow customers to build, test, publish, and integrate\n\nand plugins to meet unique security needs.\n\nThreat intelligence reports\n\nMicrosoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires\n\nlicense for at least one Defender XDR product) to get current information available in the Defender portal about\n\nthe threat actor, malicious activity, and techniques discussed in this blog. These reports provide the intelligence,\n\nprotection information, and recommended actions to help prevent, mitigate, or respond to associated threats found\n\nin customer environments:\n\nAmatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication\n\nDouble Trouble: Latrodectus and ACR Stealer observed spreading via Google\n\nPage 9 of 13\n\nLaunched\n\n– Suspicious scheduled task\n\nMicrosoft Defender for Endpoint\n\nPossible process hollowing\n\nMicrosoft Defender for Endpoint\n\n– Information stealing malware\n\nactivity\n\n– Suspicious DPAPI activity\n\n– Possible theft of passwords and other\n\nsensitive web browser information\n\nAI-powered\n\nAI agents\n\nAuthenticator Phishing Site\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nMicrosoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft\n\nDefender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the\n\nMicrosoft Defender portal to get more information about this threat actor.\n\nAdvanced hunting queries\n\nMicrosoft Defender XDR customers can run the following advance hunting queries to find related activity in their\n\nnetworks:\n\nRun the query below to identify suspicious commands executed through ClickFix-based activity observed\n\nwhile delivering this stealer\n\nDeviceRegistryEvents\n\n| where RegistryKey has \"RunMRU\"\n\n| where (RegistryValueData has_all (\"rundll32\", \"@ssl\", \" /c \", \" start \") and (RegistryValueData\n\nmatches regex @\"\\\\\\\\[^\\\\]+@ssl\\\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-\n\nF]{12}\\\\\\w+\\.\\w+,#1\" or\n\nRegistryValueData matches regex @\"(?i)pushd \\\\\\\\[^\\\\]+@ssl\\\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]\n\n{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12} \"))\n\nor RegistryValueData has_all (\"@ssl\", \" /c \", \"conhost --headless \") and RegistryValueData contains\n\n\"rundll32\"\n\nRun the query below to identify scheduled task creation used for persistence by a malicious PowerShell\n\nscript\n\nDeviceProcessEvents\n\n| where InitiatingProcessFileName =~ \"powershell.exe\"\n\n| where InitiatingProcessCommandLine has_all (\"-Command\", \"powershell\")\n\n| where ProcessCommandLine has_all (\"schtasks\", \" /run /tn \", \" Autoupdate \") and ProcessCommandLine\n\nmatches regex \"[0-9]{8}\"\n\nRun the query below to identify suspicious MSHTA launch through PowerShell\n\nDeviceProcessEvents\n\n| where InitiatingProcessParentFileName has \"explorer.exe\"\n\n| where InitiatingProcessFileName =~ \"powershell.exe\" and InitiatingProcessCommandLine in~\n\n('\"PowerShell.exe\" ', '\"PowerShell.exe\"')\n\n| where ProcessCommandLine has_all ('\"mshta.exe\" https://') and ProcessCommandLine matches regex\n\n\"/[0-9]{7}\"\n\nPage 10 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nMITRE ATT\u0026CK techniques observed\n\nThe following mapping summarizes the primary tactics and techniques observed across the two\n\nintrusion chains. The mapping is intended to help defenders align observed behaviors with existing detection\n\ncoverage, response playbooks, and hunting priorities.\n\nTactic Technique\n\nDrive-by Compromise; User\nInitial Access\nExecution\n\nCommand and Scripting Interpreter:\n\nExecution Windows Command Shell;\n\nPowerShell; Python\n\nSystem Binary Proxy Execution:\nExecution\nRundll32; Mshta\n\nPersistence Scheduled Task/Job: Scheduled Task\n\nObfuscated Files or Information;\nDefense\nMasquerading; Indicator Removal:\nEvasion\nClear Command History\n\nDefense Obfuscated Files or Information:\n\nEvasion Steganography\n\nDefense\nReflective Code Loading; Process\nEvasion /\nInjection\nExecution\n\nCredential\n\nAccess\n\nCollection\n\nCommand and\n\nControl\n\nIndicators of compromise (IOC)\n\nCredentials from Web Browsers\n\nData from Local System; Data Staged\n\nWeb Service; Dead Drop Resolver\n\nPage 11 of 13\n\nACR Stealer\n\nObserved behavior\n\nClickFix lure prompts command\n\nexecution.\n\ncmd.exe, PowerShell, and\n\npythonw.exe launch staged\n\npayloads.\n\nRundll32 loads WebDAV DLLs;\n\nmshta.exe runs remote HTA\n\ncontent.\n\nHidden scheduled task maintains\n\nuser-logon execution.\n\nObfuscation, timestomping,\n\nhistory clearing, and\n\nmasquerading.\n\nJPEG pixel data hides the\n\nencrypted payload.\n\nIn-memory shellcode execution\n\nvia runtime API resolution.\n\nBrowser stores and DPAPI\n\nactivity used to recover\n\ncredentials and tokens.\n\nPDFs, Office files, and synced\n\nenterprise data are staged.\n\nInfrastructure and blockchain\n\nRPC endpoints resolve payload\n\nor C2 data.\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nCampaign 1\n\nIndicator Description\n\nlooksta[.]icu C2 domain\n\ncontrite.quirksturdy[.]icu C2 domain\n\nux.strainedeasily[.]icu C2 domain\n\ncpppemwjewjoiwejow[.]sale C2 domain\n\nbreaksd.wifihot[.]icu C2 domain\n\nwalter.filloco[.]icu C2 domain\n\nfast.raidher[.]icu C2 domain\n\napigrokcloud[.]icu C2 domain\n\nCampaign 2\n\nenhanceblabber[.]cc\n\ndeep-harborio[.]com\n\nauramatrixa[.]com\n\nzealpraxis[.]com\n\nC2 domain\n\n1st Stage payload hosting site\n\n1st Stage payload hosting site\n\n1st Stage payload hosting site\n\nprism-vertex[.]com\n\nprism-matrixs[.]com\n\nproton-network[.]com\n\ncreativecommunityinfo[.]art\n\n1st Stage payload hosting site\n\n1st Stage payload hosting site\n\n1st Stage payload hosting site\n\nPayload hosting site\n\nReferences\n\nIntelligence Insights: May 2026 | Red Canary\n\nPossible ACR Stealer From Page Impersonating Claude\n\nLearn more\n\nFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat\n\nIntelligence Blog.\n\nTo get notified about new publications and to join discussions on social media, follow us on LinkedIn, X\n\n(formerly Twitter), and Bluesky.\n\nPage 12 of 13\n\nhttps://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nTo hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat\n\nlandscape, listen to the Microsoft Threat Intelligence podcast.\n\nReview our documentation to learn more about our real-time protection capabilities and see how to enable them\n\nwithin your organization.\n\nEvaluate your AI readiness with our latest Zero Trust for AI workshop.\n\nMicrosoft 365 Copilot AI security documentation\n\nHow Microsoft discovers and mitigates evolving attacks against AI guardrails\n\nLearn more about securing Copilot Studio agents with Microsoft Defender\n\nSource: https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/\n\nPage 13 of 13", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "origins": [ "web" ], "references": [ "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/" ], "report_names": [ "acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity" ], "threat_actors": [ { "id": "9f101d9c-05ea-48b9-b6f1-168cd6d06d12", "created_at": "2023-01-06T13:46:39.396409Z", "updated_at": "2026-10-20T02:00:15.385719Z", "deleted_at": null, "main_name": "Earth Lusca", "aliases": [ "Red Scylla", "CHROMIUM", "ControlX", "TAG-22", "Red Dev 10", "BRONZE UNIVERSITY", "AQUATIC PANDA", "RedHotel", "Charcoal Typhoon", "BountyGlad" ], "source_name": "MISPGALAXY:Earth Lusca", "tools": [ "FunnySwitch", "RouterGod", "SprySOCKS", "ShadowPad", "POISONPLUG", "Barlaiy", "Spyder" ], "source_id": "MISPGALAXY", "reports": null }, { "id": "6abcc917-035c-4e9b-a53f-eaee636749c3", "created_at": "2022-10-25T16:07:23.565337Z", "updated_at": "2026-10-20T02:00:11.124516Z", "deleted_at": null, "main_name": "Earth Lusca", "aliases": [ "Bronze University", "Charcoal Typhoon", "Chromium", "G1006", "Red Dev 10", "Red Scylla" ], "source_name": "ETDA:Earth Lusca", "tools": [ "Agentemis", "AntSword", "BIOPASS", "BIOPASS RAT", "BadPotato", "Behinder", "BleDoor", "Cobalt Strike", "CobaltStrike", "Doraemon", "FRP", "Fast Reverse Proxy", "FunnySwitch", "HUC Port Banner Scanner", "KTLVdoor", "Mimikatz", "NBTscan", "POISONPLUG.SHADOW", "PipeMon", "RbDoor", "RibDoor", "RouterGod", "SAMRID", "ShadowPad Winnti", "SprySOCKS", "WinRAR", "Winnti", "XShellGhost", "cobeacon", "fscan", "lcx", "nbtscan" ], "source_id": "ETDA", "reports": null }, { "id": "d53593c3-2819-4af3-bf16-0c39edc64920", "created_at": "2022-10-27T08:27:13.212301Z", "updated_at": "2026-10-20T02:00:10.873003Z", "deleted_at": null, "main_name": "Earth Lusca", "aliases": [ "Earth Lusca", "TAG-22", "Charcoal Typhoon", "CHROMIUM", "ControlX" ], "source_name": "MITRE:Earth Lusca", "tools": [ "Mimikatz", "PowerSploit", "Tasklist", "certutil", "Cobalt Strike", "Winnti for Linux", "Nltest", "NBTscan", "ShadowPad" ], "source_id": "MITRE", "reports": null }, { "id": "a944f36a-368d-49d4-bc10-548679e9fcf4", "created_at": "2026-09-17T02:00:03.699039Z", "updated_at": "2026-10-20T02:00:07.521166Z", "deleted_at": null, "main_name": "BRONZE UNIVERSITY", "aliases": [ "Aquatic Panda", "Aquatic Panda ", "CHROMIUM", "CHROMIUM ", "Charcoal Typhoon", "Charcoal Typhoon ", "Earth Lusca", "Earth Lusca ", "FISHMONGER ", "Red Dev 10", "Red Dev 10 ", "Red Scylla", "Red Scylla ", "RedHotel", "RedHotel ", "Tag-22", "Tag-22 " ], "source_name": "Secureworks:BRONZE UNIVERSITY", "tools": [ "Brute Ratel C4", "Cobalt Strike", "Fishmaster", "FunnySwitch", "ShadowPad", "SprySOCKS", "Spyder", "njRAT" ], "source_id": "Secureworks", "reports": null } ], "ts_created_at": 1788833015, "ts_updated_at": 1792487805, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/7c375e86a165f91b5615cf29717bc4a9b7440e4c.pdf", "text": "https://archive.orkl.eu/7c375e86a165f91b5615cf29717bc4a9b7440e4c.txt", "img": "https://archive.orkl.eu/7c375e86a165f91b5615cf29717bc4a9b7440e4c.jpg" } }