ACR Stealer Malvertising: Fake Claude AI Download Pages Deliver Windows Credential Stealer

Rudra Verma, Senior Security Architect & Researcher · 2026-05-31

An active malvertising campaign observed as recently as 2026-05-25 is distributing ACR Stealer through fake Claude AI download pages. Victims arrive at the fraudulent pages via malicious Google Ads, with the intermediary often concealed behind sites.google.com URLs to evade ad review. The pages are platform-aware: macOS visitors see macOS malware instructions; Windows visitors see the ACR Stealer Windows infection chain.

SANS ISC handler Brad Duncan confirmed the campaign on 2026-05-26 with a full IOC set including three SHA256 hashes and all C2 infrastructure. The infection chain involves three distinct download stages before the credential stealer establishes post-infection HTTPS traffic to yw.enhanceblabber[.]cc.

◈ Table of Contents

01 ACR Stealer — Malware Profile 02 Campaign Mechanics 03 Infection Chain 04 Indicators of Compromise 05 Detection & Blocking 06 MITRE ATT&CK Mapping 07 Sources

🦠

Phase 01 — ACR Stealer: Malware Profile

Malware

What ACR Stealer Does

Infostealer

ACR Stealer is a Windows infostealer sold as crimeware-as-a-service. It targets browser credentials, session cookies, cryptocurrency wallets, and file-based secrets. Post-infection traffic uses HTTPS to a dedicated C2 domain. The malware is documented in the Malpedia threat database and has been active across multiple distribution campaigns in 2025–2026.

Attribute	Detail
Malware Family	ACR Stealer (Windows infostealer)
Delivery Method	Google Ads malvertising → fake AI tool download page
Platform Targeting	Windows (ACR Stealer) / macOS (separate malware branch) — same campaign, platform-detected
C2 Protocol	HTTPS to dedicated C2 domain
Malpedia Reference	win.acr_stealer

📣

Phase 02 — Campaign Mechanics

Distribution

Google Ads → sites.google.com → Fake Claude Page

Malvertising

The campaign uses a multi-hop redirect chain to evade Google's ad review. The malicious ad leads first to a sites.google.com URL (exploiting Google Sites' reputation to pass ad review), which then redirects to the actual fake Claude download page. The lure page closely mimics the Claude branding and shows a "Download for Windows" button.

1
Google Ads search placement: Malicious ad appears for searches related to Claude or AI assistants. Ad click takes victim to a sites.google.com redirect URL — a known technique to exploit Google's own domain reputation.
2
Platform detection: The landing page detects the victim's OS. macOS users see macOS-specific instructions. Windows users see instructions that trigger the ACR Stealer chain. This is an intentional design for maximum cross-platform reach.
3
Social engineering lure: Windows victims are shown instructions to "install Claude" — actually step-by-step instructions that execute the malware. Observed instance on 2026-05-25 at fairpoint29[.]com.

🖼️

Fake Claude Download Page — Screenshot (SANS ISC)

Shows "Download for Windows" button on fraudulent Claude lure page — isc.sans.edu

→

🖼️

Fake Installation Instructions — Screenshot (SANS ISC)

Victim instructed to run a PowerShell command that installs ACR Stealer — isc.sans.edu

→

This campaign weaponizes the rising brand recognition of Claude and other AI tools. End-users searching for AI assistants are the primary target. Security awareness training should explicitly cover fake AI tool download lures as a current threat vector.

⛓️

Phase 03 — Infection Chain

3-Stage Dropper

Three-Stage Download Chain

Execution

The infection uses three sequential downloads before the final credential stealer is active. The second stage is an unusually large PowerShell script (4.1 MB). The third stage is a JPEG file that appears to participate in the infection chain even though it doesn't contain obvious malicious content.

1
Stage 1 — ZIP archive (2,416,902 bytes): Downloaded from primemetricsa[.]com/1518925. SHA256: 70b5ecc110e074dbca92932c0e840ea3492ea0a43c3f215b71392c12b02213b2. The archive has a format issue preventing extraction by standard tools — likely intentional evasion.
2
Stage 2 — PowerShell script (4,177,395 bytes): Downloaded from 6ryuefl.creativecommunityinfo[.]art/Camel-91267b64-989f-49b4-89b4-9e015844d42d. SHA256: a14c3ecf5eb3d2543358482e43dc765dbf9ee7a4bec7571f5ecb8829ca719692. ASCII text with very long lines; PowerShell execution is the primary execution mechanism.
3
Stage 3 — JPEG file (628,035 bytes): Downloaded from i.ibb[.]co/Xx16sbMz/init-block.jpg. SHA256: 47fa746422f1bf6b7712dc6803378e6a995488007193a7441d790f70d204728f. JFIF 5256×5256, purpose in chain not fully resolved — no obvious steganography but likely part of config delivery.
4
Post-infection C2: HTTPS traffic to yw.enhanceblabber[.]cc — the ACR Stealer C2 endpoint. Traffic pattern confirms infection attribution to this malware family.

🔍

Phase 04 — Indicators of Compromise

Full IOC Set

Domains & URLs

Network IOCs

IOC Type	Indicator	Role
Lure Domain	fairpoint29[.]com	Fake Claude download page (observed 2026-05-25)
Stage 1 URL	primemetricsa[.]com/1518925	Initial ZIP download
Stage 2 URL	6ryuefl.creativecommunityinfo[.]art/Camel-91267b64-989f-49b4-89b4-9e015844d42d	PowerShell script download
Stage 3 URL	i.ibb[.]co/Xx16sbMz/init-block.jpg	JPEG payload (role TBD)
C2 Domain	yw.enhanceblabber[.]cc	ACR Stealer C2 — post-infection HTTPS traffic

File Hashes (SHA256)

File IOCs

Stage	SHA256	File Type	Size
Stage 1	70b5ecc110e074dbca92932c0e840ea3492ea0a43c3f215b71392c12b02213b2	ZIP (malformed)	2,416,902 bytes
Stage 2	a14c3ecf5eb3d2543358482e43dc765dbf9ee7a4bec7571f5ecb8829ca719692	PowerShell script	4,177,395 bytes
Stage 3	47fa746422f1bf6b7712dc6803378e6a995488007193a7441d790f70d204728f	JPEG (init-block.jpg)	628,035 bytes

🛡️

Phase 05 — Detection & Blocking

Blue Team

DNS / Proxy — Block Malicious Infrastructure

Network

Firewall / Proxy — Block C2 and staging domains

# Add to DNS blocklist / proxy block list fairpoint29[.]com primemetricsa[.]com creativecommunityinfo[.]art enhanceblabber[.]cc # Note: i.ibb.co is a legitimate image hosting service — block the specific path # Block: i.ibb.co/Xx16sbMz/init-block.jpg (if proxy supports URL-level blocking)

KQL — Sentinel / Defender — Hunt for C2 traffic and PowerShell execution

// Detect outbound traffic to known ACR Stealer C2 DeviceNetworkEvents | where TimeGenerated > ago(14d) | where RemoteUrl has_any ("enhanceblabber", "fairpoint29", "primemetricsa", "creativecommunityinfo") | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName // Detect large PowerShell script download (>2MB) from external source DeviceNetworkEvents | where TimeGenerated > ago(14d) | where InitiatingProcessFileName =~ "powershell.exe" and RemotePort == 443 | where InitiatingProcessCommandLine has_any ("DownloadFile","Invoke-WebRequest","iwr","curl") | project TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemoteUrl // Hash-based hunt DeviceFileEvents | where SHA256 in ( "70b5ecc110e074dbca92932c0e840ea3492ea0a43c3f215b71392c12b02213b2", "a14c3ecf5eb3d2543358482e43dc765dbf9ee7a4bec7571f5ecb8829ca719692", "47fa746422f1bf6b7712dc6803378e6a995488007193a7441d790f70d204728f" ) | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256

This campaign has been running reliably across multiple weeks (since at least 2026-05-11 per SANS ISC prior reports). The lure domains rotate but the C2 infrastructure pattern (short subdomain + short second-level domain + .cc TLD) has been consistent. Build a behavioral detection on outbound HTTPS from powershell.exe to newly registered .art and .cc domains as a durable detection layer.

User-Facing Controls

Prevention

🔒

Allowlist Software Sources

Enforce software installation only from approved, known-good sources. End-users should not be able to install software downloaded from arbitrary websites, including via PowerShell instructions from web pages.

📧

Security Awareness

Train users on AI-tool brand impersonation lures specifically. Claude, ChatGPT, and Gemini are all being used as lure brands. Official download sources should be bookmarked, not searched via Google Ads.

🚫

Block sites.google.com Redirect Chains

Consider web proxy policies that flag or alert on sites.google.com pages that immediately redirect to third-party domains — this is the primary evasion technique used in ad review.

🗺️

Phase 06 — MITRE ATT&CK Mapping

ATT&CK

Tactic	ID	Technique	Evidence
Initial Access	T1566.002	Phishing: Spearphishing Link	Malvertising → fake download page
Execution	T1059.001	PowerShell	4.1MB PowerShell script (Stage 2)
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name	Fake Claude download page impersonation
Defense Evasion	T1027	Obfuscated Files or Information	Malformed ZIP, obfuscated PS1
Credential Access	T1555.003	Credentials from Web Browsers	Browser credential theft (ACR Stealer)
Credential Access	T1539	Steal Web Session Cookie	Session cookie harvesting
Exfiltration	T1041	Exfiltration Over C2 Channel	HTTPS to yw.enhanceblabber[.]cc

📚

Phase 07 — Sources & References

Attribution

SANS ISC Diary #33018 — Possible ACR Stealer From Page Impersonating Claude (Brad Duncan, 2026-05-26) Malpedia — win.acr_stealer family profile Malware Traffic Analysis — Prior Claude lure campaign sample (2026-05-11) VirusTotal — Stage 1 ZIP hash (70b5ecc1...) VirusTotal — Stage 2 PowerShell hash (a14c3ecf...)

🔍 Check Your Environment for ACR Stealer IOCs

Paste the three SHA256 hashes and domain IOCs from this post into the CyberHawk IOC Scanner for instant lookups across threat intel databases. Bulk lookups supported — ideal for checking EDR telemetry exports.

→ cyberhawkthreatintel.com/ioc-scanner

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram

🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."