s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2020320 high

📛 Threat Title

ACR Stealer: Domain that is used for botnet Command&control (C&C) tawnyfoldton.cc

Category: ACR Stealer Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain tawnyfoldton.cc UrlVoid 0 / 36

IOC database

Type
domain
Value
tawnyfoldton.cc
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain that is used for botnet Command&control (C&C) attributed to ACR Stealer

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-11-08 07:37:52 UTC. Reporter: abuse_ch. Tags: ACRStealer.

Remediations (10)

  • ACR Stealer - Uncovering Attack Chains, Functionalities And IOCs
    web:cybersecuritynews.com

    This malware has gained particular notoriety for its innovative use of legitimate platforms as command-and-control infrastructure, making detection and mitigation exceptionally challenging for security teams.

  • ACR Stealer malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    2,127 indicators of compromise attributed to the ACR Stealer malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  • PDF ACR Stealer's ClickFix Campaigns Drain M365 Tokens
    web:labs.cloudsecurityalliance.org

    Key Takeaways • Microsoft Defender Experts tracked a sustained rise in ACR Stealer activity from late April through mid-June 2026, delivered through two distinct ClickFix intrusion chains that both begin with a victim pasting an attacker-supplied command into the Windows Run dialog [1][2].

  • ACR Stealer (Malware Family) - Fraunhofer
    web:malpedia.caad.fkie.fraunhofer.de

    The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs.

  • ACR Stealer Uses ClickFix and Dual Intrusion Chains
    web:socprime.com

    ACR Stealer is an information-stealing malware family that uses ClickFix-style social engineering lures to target enterprise environments. The malware operates through two main infection chains: one that relies on WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control, and another that uses MSHTA with ...

  • ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft ...
    web:thehackernews.com

    ACR Stealer campaigns use ClickFix lures, JPEG steganography, and WebDAV to steal browser tokens, passwords, PDFs, and synced Microsoft 365 files.

  • Defender Warns: ClickFix ACR Stealer Steals Browser Tokens
    web:windowsforum.com

    Microsoft Defender Experts says two ACR Stealer campaigns observed from late April through mid-June 2026 are using ClickFix prompts to turn ordinary browser activity into enterprise credential theft.

  • ACR Stealer: Two observed intrusion chains amid increased threat ...
    web:www.microsoft.com

    From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.

  • ACR Stealer - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Throughout its existence ACR has used various tactics for C&C (Command and Control) servers, and the newest versions have relied on unique platforms like obtaining commands from Google Docs. The stealer can extract data from systems and installed applications (non-exhaustive list below).

  • Botnet C&C | Blogs, news articles and reports | Spamhaus
    web:www.spamhaus.org

    With every Botnet Threat Update we publish, the same networks consistently appear in the Top 20 for hosting botnet command and control (C&C) servers. But why does this keep happening? In this Botnet Spotlight, we look into the root causes behind this persistent issue and what networks must do to break the cycle. Botnet C&C Malware Service providers

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.