TF-2020314
high
📛 Threat Title
ACR Stealer: Domain that is used for botnet Command&control (C&C) lintmoorley.cc
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
lintmoorley.cc
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
lintmoorley.cc- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to ACR Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.
Remediations (10)
-
web:apexthreatanalyzer.com
Description Indicator that identifies a botnet command&control server ( C&C ). IOC type: Domain that is used for botnet Command&control ( C&C ). Attributed malware: ACR Stealer . Confidence: 100. First seen: 2026-06-03 06:08:25 UTC. Reporter: abuse_ch. Tags: ACRStealer .
-
web:cyberreplay.com
Q: What is the first practical step if I suspect ACR Stealer in my environment? A: Isolate suspected hosts from domain controllers and cloud consoles, collect volatile evidence, and force rotation of impacted credentials. Use the 4-hour playbook above and run immediate SIEM hunts for browser profile reads and unusual POST activity.
-
web:cybersecuritynews.com
This malware has gained particular notoriety for its innovative use of legitimate platforms as command-and-control infrastructure, making detection and mitigation exceptionally challenging for security teams.
-
web:cyfar.ca
What Happened Microsoft found attackers tricking users into copying and running a malicious command (a trick called 'ClickFix,' often shown as a fake verification or CAPTCHA prompt) that installs an information-stealing program called ACR Stealer .
-
web:ismalicious.com
2,127 indicators of compromise attributed to the ACR Stealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:malpedia.caad.fkie.fraunhofer.de
The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs.
-
web:socprime.com
ACR Stealer is an information-stealing malware family that uses ClickFix-style social engineering lures to target enterprise environments. The malware operates through two main infection chains: one that relies on WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control, and another that uses MSHTA with ...
-
web:techjacksolutions.com
Step 1: Containment — Immediately revoke all active session tokens for accounts in affected environments; password resets alone do not invalidate live tokens stolen by ACR Stealer . Use Microsoft Entra ID (Azure AD) to perform forced sign-out and token revocation for users on Windows endpoints accessing Microsoft 365, OneDrive, and SharePoint.
-
web:www.microsoft.com
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.
-
web:www.pcrisk.com
Throughout its existence ACR has used various tactics for C&C (Command and Control) servers, and the newest versions have relied on unique platforms like obtaining commands from Google Docs. The stealer can extract data from systems and installed applications (non-exhaustive list below).
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.