We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer.
https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694
#ThreatIntel #ThreatIntelligence #IFIN
IFIN - The Independent Federated Intelligence Network
npub1qm…nh363
2026-07-29 21:58:35 UTC
Author Public Key
npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363Seen on
wss://relay.momostr.pinkPublished at
2026-07-29 21:58:35 UTCEvent JSON
{
"id": "3445ad0a2361caf9d39b41c0a6ae1c553f6ca5bf6a3f20f0b9d08f3911499786",
"pubkey": "06eab22dbb1f669b7c8ec534a0f9011c3cf56c56c57900334b3cbb16c6afcb03",
"created_at": 1785362315,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@ifin/117005504689696669",
"web"
],
[
"t",
"threatintelligence"
],
[
"t",
"ifin"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/ap/users/115741367687413652/statuses/117005504689696669",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/115741367687413652/statuses/117005504689696669",
"pink.momostr"
],
[
"-"
]
],
"content": "We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for \"just\" an infostealer.\n\nhttps://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694\n\n#ThreatIntel #ThreatIntelligence #IFIN",
"sig": "f9b7ea86f1bee4e14c1d961c4a4a38d178fe0467740c286d61dbe1e0aff934b6f427142baeab28bb8d0c4592810bbaeec7f3c56c7fdca246b2bc51b164f485eb"
}