Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
ACR Stealer: Two observed intrusion chains amid increased threat activity
Excerpt
In this article Campaign 1: WebDAV-based ClickFix with Python loaders and blockchain C2 Campaign 2: MSHTA-initiated PowerShell chain with steganographic payload delivery Mitigation and protection guidance References Learn more From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | apigrokcloud.icu | High | Score 58/100 | First seen |
| Domain | prism-matrixs.com | High | Score 58/100 | First seen |
| Domain | walter.filloco.icu | High | Score 58/100 | First seen |
| Domain | zealpraxis.com | High | Score 58/100 | First seen |
| Domain | auramatrixa.com | High | Score 58/100 | First seen |
| Domain | fast.raidher.icu | High | Score 58/100 | First seen |
| Domain | creativecommunityinfo.art | High | Score 68/100 | First seen |
| Domain | ux.strainedeasily.icu | High | Score 58/100 | First seen |
| Domain | breaksd.wifihot.icu | High | Score 58/100 | First seen |
| Domain | cpppemwjewjoiwejow.sale | High | Score 68/100 | First seen |
| Domain | contrite.quirksturdy.icu | High | Score 58/100 | First seen |
| Domain | proton-network.com | High | Score 58/100 | First seen |
| Domain | enhanceblabber.cc | High | Score 69/100 | First seen |
| Domain | deep-harborio.com | High | Score 58/100 | First seen |
| Domain | looksta.icu | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…