Possible ACR Stealer From Page Impersonating Claude, (Tue, May 26th)
Source SANS ISC Handlers Diary
Description
Introduction
Impact
Successful victim interaction with these fake Claude pages can lead to infection with ACR Stealer malware on Windows systems. This malware likely exfiltrates sensitive information to a remote command-and-control server. The infection chain involves multiple downloads, including a corrupted zip archive and a PowerShell script, which may evade simple detection. There are no reports of exploitation beyond these observed infection attempts. The threat primarily impacts users who follow the malicious instructions and download the payloads.
Defensive guidance
Defenders should block access to the identified malicious domains and URLs (e.g., fairpoint29.com, primemetricsa.com, creativecommunityinfo.art, i.ibb.co, enhanceblabber.cc). Users should be warned not to trust unsolicited download links or instructions from unverified sources, especially those impersonating legitimate platforms like Claude. Endpoint protection solutions should be updated to detect and block ACR Stealer and associated PowerShell scripts. Since this is a malware distribution campaign via social engineering, user awareness training is critical. Monitor for indicators of compromise related to the provided hashes and domains.
Summary
Recent investigations revealed web pages impersonating the Claude AI platform that distribute malware, notably ACR Stealer, via malicious ads in Google search results. These pages tailor their displayed instructions based on the visitor's OS, showing Windows or macOS malware installation steps accordingly. The infection chain involves an initial corrupted zip archive download, followed by a PowerShell script and an associated image file, culminating in communication with a C2 server (yw.enhanceblabber.cc). The infection is initiated from URLs such as fairpoint29.com and primemetricsa.com. The image file appears benign but is part of the infection chain.