ACR Stealer: Reading Its C2 Off Steam and Google Docs

ACR Stealer is a Windows information stealer sold as malware-as-a-service, assessed as an evolved version of the earlier GrMsk Stealer. It is known for dead-drop-resolver (DDR) command-and-control: rather than hardcoding a C2 address, the malware reads a Base64-encoded C2 domain from a page it controls on a legitimate, high-reputation service, decodes it, and only then contacts the real C2. That lets operators rotate C2 by editing a public page and blends beaconing in with normal traffic to trusted domains. It spiked in distribution from January 2025 via cracked-software lures, often alongside Lumma, and Proofpoint later assessed it was rebranded as Amatera Stealer.

Overview

ACR was advertised on the Russian-language forum RAMP in late March 2024 by an actor using the handle “SheldIO,” and sold as MaaS. A subscription price could not be verified. Note that ACR is distinct from Acreed, a separate, similarly named 2025 stealer — do not conflate them. Newer ACR and Amatera builds abandoned DDR in favour of lower-level C2.

The Dead-Drop Resolver

AhnLab ASEC documented ACR reading its C2 configuration from pages on Steam, telegra.ph and Google Docs (Forms and Presentations). A process fetching a short Base64 blob from one of these reputable services and then beaconing to a different, newly seen domain is the classic DDR pattern. T1102 T1071.001

Technical Capabilities

• Browser credentials, cookies, autofill and card data from Chromium and Gecko browsers. T1555.003 T1539
• Cryptocurrency wallets and, per operator configuration, credential managers and files — the C2 returns a target list that drives collection. T1005
• Later builds use Heaven’s Gate (32-to-64-bit transition) for evasion and talk directly to the Ancillary Function Driver via low-level NT syscalls, bypassing Winsock. T1055

Delivery

ACR spreads through cracked-software and keygen lure pages, paired with Lumma in some campaigns, and in 2025 and 2026 through HijackLoader and ClickFix fake-verification chains that instruct victims to run PowerShell. T1204.004 T1059.001

MITRE ATT&CK Mapping

Detection & Mitigation

• Alert on a process fetching a short Base64 string from Steam, telegra.ph or Google Docs and then connecting to a newly seen domain.
• Watch for Heaven’s Gate behaviour (a 32-bit process executing 64-bit code) and raw \Device\Afd socket activity without Winsock DLL loads.
• Block cracked-software download categories; constrain PowerShell; train users against ClickFix paste-and-run prompts.
• Rotate browser-stored credentials after infection and enforce phishing-resistant MFA.