TF-2020315
high
📛 Threat Title
ACR Stealer: Domain that is used for botnet Command&control (C&C) mirthvaleway.cc
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
mirthvaleway.cc
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
mirthvaleway.cc- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to ACR Stealer
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.
Remediations (10)
-
web:cybersecuritynews.com
This malware has gained particular notoriety for its innovative use of legitimate platforms as command-and-control infrastructure, making detection and mitigation exceptionally challenging for security teams.
-
web:ismalicious.com
2,127 indicators of compromise attributed to the ACR Stealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:labs.cloudsecurityalliance.org
Key Takeaways Microsoft Defender Experts tracked a sustained rise in ACR Stealer activity from late April through mid-June 2026, delivered through two distinct ClickFix intrusion chains that both begin with a victim pasting an attacker-supplied command into the Windows Run dialog [1] [2].
-
web:malpedia.caad.fkie.fraunhofer.de
The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs.
-
web:thehackernews.com
ACR Stealer campaigns use ClickFix lures, JPEG steganography, and WebDAV to steal browser tokens, passwords, PDFs, and synced Microsoft 365 files.
-
web:winbuzzer.com
Microsoft warns that increased ACR Stealer activity uses ClickFix, WebDAV, and MSHTA routes to steal enterprise credentials, tokens, and cloud documents.
-
web:windowsforum.com
Microsoft Defender Experts says two ACR Stealer campaigns observed from late April through mid-June 2026 are using ClickFix prompts to turn ordinary browser activity into enterprise credential theft.
-
web:www.microsoft.com
The following mapping summarizes the primary tactics and techniques observed across the two ACR Stealer intrusion chains. The mapping is intended to help defenders align observed behaviors with existing detection coverage, response playbooks, and hunting priorities.
-
web:www.myabt.com
A ClickFix lure plus the ACR Stealer infostealer can hand an attacker a working Microsoft 365 login, no password and no CVE to patch. Here is the defense.
-
web:www.pcrisk.com
Throughout its existence ACR has used various tactics for C&C (Command and Control) servers, and the newest versions have relied on unique platforms like obtaining commands from Google Docs. The stealer can extract data from systems and installed applications (non-exhaustive list below).
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.