ACRStealer high-entropy repeated-label DNS canary connectivity check

Duo Tech@duotech

•updated Aug 17, 2026•0•0•2

Detects a DNS query with a high-entropy label repeated identically as both subdomain and domain (e.g. X.X), used by ACRStealer as a connectivity/canary check prior to establishing C2.