TF-2020316
high
📛 Threat Title
ACR Stealer: Domain that is used for botnet Command&control (C&C) payneofin.cc
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
payneofin.cc
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
payneofin.cc- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to ACR Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.
Remediations (10)
-
web:cyber-osint.io
Microsoft Defender Experts observed heightened ACR Stealer activity from late April to mid-June 2026, targeting enterprise environments through two distinct intrusion chains.
-
web:cyberreplay.com
Q: What is the first practical step if I suspect ACR Stealer in my environment? A: Isolate suspected hosts from domain controllers and cloud consoles, collect volatile evidence, and force rotation of impacted credentials. Use the 4-hour playbook above and run immediate SIEM hunts for browser profile reads and unusual POST activity.
-
web:cybersecuritynews.com
This malware has gained particular notoriety for its innovative use of legitimate platforms as command-and-control infrastructure, making detection and mitigation exceptionally challenging for security teams.
-
web:ismalicious.com
2,127 indicators of compromise attributed to the ACR Stealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:labs.cloudsecurityalliance.org
Key Takeaways Microsoft Defender Experts tracked a sustained rise in ACR Stealer activity from late April through mid-June 2026, delivered through two distinct ClickFix intrusion chains that both begin with a victim pasting an attacker-supplied command into the Windows Run dialog [1] [2].
-
web:malpedia.caad.fkie.fraunhofer.de
The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs.
-
web:socprime.com
ACR Stealer is an information-stealing malware family that uses ClickFix-style social engineering lures to target enterprise environments. The malware operates through two main infection chains: one that relies on WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control, and another that uses MSHTA with ...
-
web:thehackernews.com
ACR Stealer campaigns use ClickFix lures, JPEG steganography, and WebDAV to steal browser tokens, passwords, PDFs, and synced Microsoft 365 files.
-
web:www.microsoft.com
The following mapping summarizes the primary tactics and techniques observed across the two ACR Stealer intrusion chains. The mapping is intended to help defenders align observed behaviors with existing detection coverage, response playbooks, and hunting priorities.
-
web:www.proofpoint.com
This shellcode ultimately runs Amatera Stealer . Malware analysis Overview Amatera Stealer is a stealer written in C++ which is actively being developed and maintained as a MaaS. The rebranded malware is equipped with new features, including improved stealer capabilities and evasion features used to circumvent detection.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.