ACR Stealer - C2 Domain Communication
Detects DNS resolution or network connections to command-and-control domains associated with ACR Stealer campaigns observed in mid-2026 intrusion chains. ACR Stealer exfiltrates browser credential stores (Login Data, Web Data) and beacons to short-lived infrastructure hosted under .icu, .sale, .cc, .com and .art TLDs. Any observed communication to these domains indicates an active infection.
YARA-L
