Loading malware…
ACRStealer is a Windows-focused information-stealing malware family, also reported as having been rebranded as AmateraStealer. It steals browser credentials, cookies, saved payment-card data, cryptocurrency-wallet data, authentication tokens, password-manager data, email and FTP client data, VPN and remote-access data, cloud-storage tokens, documents, and credentials from developer and AI-assistant environments, including API keys and related configuration data. Stolen information is commonly collected into archives and exfiltrated over HTTPS or HTTP-based command-and-control channels. Variants use dead-drop resolvers hosted on legitimate online platforms to obtain command-and-control infrastructure.
ACRStealer campaigns have used multilayer PowerShell, Python, Go, and .NET loader chains; in-memory execution; obfuscation; anti-analysis measures; security-product evasion; process injection; and DLL sideloading. Delivery has been observed through cracked-software and key-generator lures, SEO-poisoned and fraudulent developer-documentation pages, fake software updates, ClickFix or fake-CAPTCHA social engineering, trojanized installers, malicious archive files, and loader ecosystems including HijackLoader. Campaigns have targeted developers and AI-tool users as well as broader consumer and enterprise populations. ACRStealer has also been delivered in ClearFake activity involving compromised websites and browser-based ClickFix lures.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
ClearFake spreads by compromising legitimate websites and injecting hidden JavaScript code into their pages. Victims do not need to do anything suspicious to get infected. Simply visiting a tampered legitimate site can trigger the malware’s multi-stage delivery chain.
Blackpoint SOC alerted to suspicious cmd.exe usage by a user on a host... The command used cmd.exe to pull a second-stage DLL from an attacker-controlled WebDAV server and launch it via rundll32.
Stage 1 -- ACRStealer Dropper : A PowerShell script hosted at hxxps://casyetnx[.]pw/eq8e1l4b0qjd22w
Distribution exploiting Renpy (a Python-based open-source game development tool) was identified. Inside a ZIP file, setup.Exe and setup.Py were linked to execute malicious scripts sequentially, ultimately launching ACRStealer.
Experts found various delivery techniques, such as rundll32.exe loading infected DLLs, Base64-encoded commands, mshta.exe abuse, JavaScript-based payloads, and GitHub-hosted scripts.
Windows users were instructed to open the Run dialog and paste it, loading a remote DLL into memory with no file ever written to disk.
A ClickFix-style social engineering attack tricked a user into running a command that pulled a malicious DLL loader from an attacker-controlled WebDAV server and launched it using rundll32.
The attacker directly tampered with and injected malicious code into a specific Python script (.py) inside the legitimate Python library folder (Lib). They then packaged this modified script together with a legitimate Python executable into a compressed archive and distributed it.
Experts found various delivery techniques, such as rundll32.exe loading infected DLLs, Base64-encoded commands... After execution, the malware uses a multi-level malicious chain that features encoded C2 communications...
After execution, the malware uses a multi-level malicious chain that features encoded C2 communications, anti-analysis capabilities, fileless execution tactics, and credential theft functions.
The report includes cases involving disguising as cracks and keygens... Statistics on companies disguised by new malware... were extracted based on version and certificate information.
Experts found various delivery techniques, such as rundll32.exe loading infected DLLs, Base64-encoded commands, mshta.exe abuse, JavaScript-based payloads, and GitHub-hosted scripts.
The command used cmd.exe to pull a second-stage DLL from an attacker-controlled WebDAV server and launch it via rundll32.
After execution, the malware uses a multi-level malicious chain that features encoded C2 communications, anti-analysis capabilities...
Victims on Windows and macOS were routed to separate payloads tailored to their operating system, with routing handled by real-time OS detection in the browser.
The attacker directly tampered with and injected malicious code into a specific Python script (.py) inside the legitimate Python library folder (Lib). They then packaged this modified script together with a legitimate Python executable into a compressed archive and distributed it.
Victims saw a convincing fake Google reCAPTCHA overlay complete with an “I’m not a robot” checkbox. Clicking it triggered the ClickFix social engineering panel...
Contrary to infostealers, the campaign pick on AI assets like authentication tokens, API Key, and cloud development credentials from tools such as Continue[.]dev, Cline.
ACRStealer, a C++ infostealer that harvests passwords, credit card numbers, cookies, and cryptocurrency wallet data.
The agents actively searched server-side systems, identified weaknesses, and carried out targeted actions against online infrastructure... [The Recon] dashboard was designed to organize, validate, and manage more than 23,800 stolen secrets in real time, including API keys connected to cloud and AI services.
Victims saw a convincing fake Google reCAPTCHA overlay complete with an “I’m not a robot” checkbox. Clicking it triggered the ClickFix social engineering panel...
Clicking it triggered the ClickFix social engineering panel, which simultaneously injected a malicious command directly into the victim’s clipboard.
What It Steals ACRStealer targets a comprehensive list: Chrome, Firefox, Edge, Opera, Brave, and Vivaldi browser data (logins, cookies, history, autofill, credit cards); crypto wallets ... FTP clients ... email ... VPN configs ... password managers ... and chat apps
Threat actors used a technique called EtherHiding to store payload routing instructions inside blockchain smart contracts, bypassing all URL-based blocking methods entirely.
Dead Drop Resolver: Hiding C2 in Plain Sight ... The attacker creates profiles on Steam Community, Google Docs, Google Slides, or Telegram ... The malware fetches the page ... and decodes the Base64 to obtain the real C2 address
176 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer distributed through cracked-software disguises and through a Renpy-based archive chain in which setup.exe and setup.py execute malicious scripts that launch the stealer.
A credential-stealing malware/tool referenced only through collection rules targeting AI coding-assistant configuration files that may contain secrets.
A credential-stealing malware referenced only through its collection rules targeting AI coding-assistant configuration files, including secrets.json and config.yaml.
Credential stealer identified in the IoC listing as targeting Cline and Continue AI configuration files for plaintext API keys and model-routing endpoints.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.