ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My
12 hours ago
- The ACR Stealer campaign uses a multi-stage infection chain starting with ClickFix initial access via pcalua.exe executing PowerShell.
- Stage 1: pcalua.exe runs PowerShell to launch mshta.exe, which downloads an .mp3 file containing obfuscated VBScript.
- Stage 2: The VBScript creates a scheduled task 'serviceyib' that runs PowerShell with an encoded command.
- Stage 3: PowerShell performs AMSI bypass via custom RC4 decryption, then downloads and executes a next stage from a C2 domain.
- Stage 4: Steganography is used—an image from i.ibb.co is chunked into 8x8 blocks, decoded via grayscale averaging, XORed, and decompressed to reveal more PowerShell.
- Stage 5: A shellcode loader performs reflective process injection to load a compressed PE as the final payload.
- Stage 6: The final payload is ACR Stealer, masquerading as WPA.exe, with heavy anti-analysis (no static imports, direct syscalls, PEB walking).
- The article notes that the complex obfuscation may indicate AI-assisted development, making such techniques accessible to more threat actors.