s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2020321 high

📛 Threat Title

ACR Stealer: Domain that is used for botnet Command&control (C&C) willowfenham.cc

Category: ACR Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain willowfenham.cc UrlVoid 0 / 36

IOC database

Type
domain
Value
willowfenham.cc
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain that is used for botnet Command&control (C&C) attributed to ACR Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.

Remediations (10)

  • ACR Stealer - Uncovering Attack Chains, Functionalities And IOCs
    web:cybersecuritynews.com

    This malware has gained particular notoriety for its innovative use of legitimate platforms as command-and-control infrastructure, making detection and mitigation exceptionally challenging for security teams.

  • ACR Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    2,127 indicators of compromise attributed to the ACR Stealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  • ACR Stealer's ClickFix Campaigns Drain M365 Tokens
    web:labs.cloudsecurityalliance.org

    Key Takeaways Microsoft Defender Experts tracked a sustained rise in ACR Stealer activity from late April through mid-June 2026, delivered through two distinct ClickFix intrusion chains that both begin with a victim pasting an attacker-supplied command into the Windows Run dialog [1] [2].

  • ACR Stealer (Malware Family) - Fraunhofer
    web:malpedia.caad.fkie.fraunhofer.de

    The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs.

  • ACR Stealer Uses ClickFix and Dual Intrusion Chains
    web:socprime.com

    ACR Stealer is an information-stealing malware family that uses ClickFix-style social engineering lures to target enterprise environments. The malware operates through two main infection chains: one that relies on WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control, and another that uses MSHTA with ...

  • ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft ...
    web:thehackernews.com

    ACR Stealer campaigns use ClickFix lures, JPEG steganography, and WebDAV to steal browser tokens, passwords, PDFs, and synced Microsoft 365 files.

  • New ACR Stealer campaigns use WebDAV, MSHTA to evade detection
    web:www.csoonline.com

    Microsoft has warned that attackers are varying their post-exploitation techniques while relying on the same ClickFix lure, making related ACR Stealer incidents harder to connect.

  • ACR Stealer: Two observed intrusion chains amid increased threat ...
    web:www.microsoft.com

    The following mapping summarizes the primary tactics and techniques observed across the two ACR Stealer intrusion chains. The mapping is intended to help defenders align observed behaviors with existing detection coverage, response playbooks, and hunting priorities.

  • ACR Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Throughout its existence ACR has used various tactics for C&C (Command and Control) servers, and the newest versions have relied on unique platforms like obtaining commands from Google Docs. The stealer can extract data from systems and installed applications (non-exhaustive list below).

  • Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
    web:www.spamhaus.org

    The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.