ACR Stealer
ACR Stealer is a malware-as-a-service (MaaS) information stealer written in C++ and active since 2024. It is described as a credential and data theft infostealer and has been linked to the SideCopy threat group. Reported theft capabilities include browser credentials, passwords, cookies, session tokens, sensitive files, system information, clipboard contents, installed antivirus details, and cryptocurrency wallet data. MS-ISAC reporting states it uses HTTP and TCP for command-and-control and can establish persistence via AutoRun registry keys or the Startup folder, depending on the host environment.
The malware has been observed as a final payload in multiple delivery chains and campaigns. Recent reporting ties it to ClearFake drive-by and fake CAPTCHA/paste-and-run campaigns, fake Claude/Claude Code installation pages promoted through Google Ads malvertising, cracked software and pirated game distribution chains, and RenEngine/HijackLoader-based infections delivered through trojanized Ren'Py launchers. It has also been referenced as a payload delivered through crypters and loaders including Hijack Loader and RenEngine Loader. One analyzed fake Claude infection chain involved fairpoint29.com, primemetricsa.com, a creativecommunityinfo.art subdomain, and post-infection traffic assessed as ACR Stealer-related.
The malware is also associated with the ACR Stealer-based Amatera MaaS platform, which is described as being based on ACR Stealer and sold as a subscription service. Reporting further notes ACR Stealer-related naming in darknet marketplace activity, including payload names such as acr-arab, acr-karma, and acr-xyphos, matching a product sold by SheldIO on the RAMP forum.
Observed targeting and victimology in related campaigns include broad opportunistic infections affecting Windows users, including users seeking pirated games, cracked applications, and fake software installers. Reported geographic impact in associated campaigns includes India, the United States, Brazil, Russia, Spain, Turkey, and Germany. High-confidence indicators directly mentioned in the content include SHA256 70b5ecc110e074dbca92932c0e840ea3492ea0a43c3f215b71392c12b02213b2, a14c3ecf5eb3d2543358482e43dc765dbf9ee7a4bec7571f5ecb8829ca719692, and 47fa746422f1bf6b7712dc6803378e6a995488007193a7441d790f70d204728f; domains and URLs fairpoint29.com, primemetricsa.com/1518925, 6ryuefl.creativecommunityinfo.art, and i.ibb.co/Xx16sbMz/init-block.jpg; and the detection name Trojan-PSW.Win32.ACRstealer.gen.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ACR Stealer, a malware-as-a-service (MaaS) information stealer written in C++ that has been active since 2024, makes its debut in a tie for 6th thanks to its use as a payload in recent ClearFake campaigns.
The top buyer @dearswa placed 24 orders for payloads named acr-arab , acr-karma , and acr-xyphos . The acr-* naming convention directly matches ACR Stealer , a Malware-as-a-Service product sold by SheldIO on the RAMP darknet forum.
ACR Stealer is a credential and data theft infostealer written in C++ and used by the SideCopy threat group.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Command and Control
3 techniques
Command and Control
Based on the C2 domain for post-infection traffic, this appears to be an infection for ACR Stealer... Domain for post-infection HTTPS traffic to C2 server
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information-stealing malware identified from post-infection C2 traffic associated with a fake Claude download page delivering Windows malware.
Stealer family referenced as the codebase/basis for the Amatera MaaS infostealer.
Referenced as the apparent codebase Amatera Stealer is believed to be derived from; described as a stealer offered to criminals via a subscription/MaaS model.
Credential-stealing malware sold as a Malware-as-a-Service offering and deployed through this PPI botnet by one of the buyers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.