ACR StealerMalware
First introduced in March 2024, ACR Stealer is an information stealer sold as a Malware-as-a-Service (MaaS) on Russian-speaking cybercrime forums by a threat actor named "SheldIO". Researchers posit that this malware is an evolved version of the GrMsk Stealer, which likely aligns with the private stealer that SheldIO has been selling since July 2023.From MISP Galaxy
Last reported 3 months ago, by Red Canary2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1055Process Injection
“Malware loader that uses DLL sideloading to deliver additional payloads through process injection”
- T1204.004Malicious Copy and Paste
“…ites to deliver malware via drive-by download techniques, often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA).”
- T1556.009Conditional Access Policies
“If the victim enters the user_code and completes authorization—including the satisfaction of Conditional Access policies—the Kali365 platform collects the returned, valid access token.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Intelligence Insights: July 2026“ACR Stealer”
-
Intelligence Insights: June 2026“ACR Stealer”
Indicators in its reports
named in the reports above- ai-scan[.]digitalin 1 report
- bg-transparency[.]onlinein 1 report
- linkedall[.]orgin 1 report
- golinked[.]netin 1 report
- indeed-jobs[.]netin 1 report
- cheeshomireciple[.]comin 1 report
- hxxps://mirtona[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc12in 1 report
- mirtona[.]comin 1 report
- hxxps://amber-22[.]com/api/metrics/run?event=pastedin 1 report
- amber-22[.]comin 1 report
- hxxp://195.10.205[.]212/Cpchain 1 report
- 195.10.205[.]212in 1 report
- 35613analytics[.]comin 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.