ACR Stealer and EtherHiding: the C2 you cannot take down

Every takedown you have ever read about depends on one assumption: somewhere in the attacker's infrastructure there is a thing you can seize. A domain a registrar can suspend. A VPS a hoster can null-route. A bucket a cloud provider can disable. The entire defensive economy around C2 — blocklists, sinkholes, reputation feeds, coordinated disruption — is built on that single point of leverage.

On 16 July 2026, Microsoft Threat Intelligence published its analysis of ACR Stealer, covering a surge in activity that Defender Experts observed across customer environments from late April to mid-June 2026. Buried in the second half of the report is the detail that matters more than the malware family itself: a subset of the intrusions used a secondary Python loader that pulled its next-stage payload location from public blockchain RPC endpoints and third-party Web3 node infrastructure.

That is the assumption breaking. There is no registrar to email.

What Microsoft actually observed

ACR Stealer is not novel. Per Red Canary's April 2026 Intelligence Insights, it is a malware-as-a-service infostealer written in C++, active since 2024, marketed on Russian-speaking forums by an actor tracked as "SheldIO" and assessed to be an updated GrMsk Stealer. BleepingComputer reported on 18 July that it is also a rebrand of Amatera Stealer.

What changed is volume and delivery. In the same April 2026 data, Red Canary put ClearFake at the top of its prevalence list for the first time, with ACR Stealer debuting in a tie for sixth — it rides ClearFake as a payload. One observed April campaign lured developers with fake Claude Code installation pages at claude-desktop[.]gitlab[.]io, using the paste-and-run pattern.

Microsoft documented two chains. Both begin with a ClickFix prompt — the user is socially engineered into pasting a command into the Run dialog themselves.

Chain 1 (disk-writing): cmd.exe invokes rundll32.exe to load a DLL from a remote WebDAV share over HTTPS, using GUID-based directories and filenames dressed up as legitimate resources (google.ct). Variants mount the share with pushd or wrap execution in conhost.exe --headless. An obfuscated PowerShell stage drops a payload into %LocalAppData%\Temp under a plausible name — LogiOptionsPlus — and runs a Python script through a bundled pythonw.exe. Persistence is a hidden scheduled task disguised as a software updater. The loader resolves APIs at runtime and executes shellcode through VirtualAlloc and the Windows Fiber API (ConvertThreadToFiber, CreateFiber, SwitchToFiber) — an execution path that sidesteps the thread-creation telemetry most detections key on.

Chain 2 (fileless): mshta.exe retrieves remote HTA content, a VBScript loader pivots through COM into PowerShell, and PowerShell pulls a JPEG from an image-hosting service. The payload is extracted from the image pixels, decrypted, decompressed, and executed reflectively.

The blockchain resolver appears in a subset of Chain 1.

EtherHiding: why the C2 has no seizable resolver

The technique Microsoft names here is EtherHiding, and the clearest technical treatment remains Google Threat Intelligence Group's October 2025 analysis. The mechanics are worth stating precisely, because the security-industry shorthand ("malware on the blockchain") gets the important part wrong.

The attacker deploys a smart contract on a public chain — BNB Smart Chain and Ethereum in the documented cases. The contract stores an encrypted blob: typically an IV plus the C2 address or next-stage payload. The implant reads it with a read-only call (eth_call). That call creates no transaction. It costs no gas. It leaves no record on the ledger.

GTIG traced the technique to UNC5142 and the CLEARFAKE campaign in September 2023, and documented DPRK-nexus UNC5342 adopting it from February 2025. One UNC5342 contract — 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c — was updated more than twenty times in four months, at roughly $1.37 in gas per update.

Compare the takedown surface honestly:

C2 resolution method	What a defender can seize	Cost to the operator of losing it
Hardcoded IP / domain	The host, the domain	Full infrastructure rebuild
DGA	Pre-registered domains, the seed	Moderate — burn the seed, ship a new build
Fast-flux / bulletproof hosting	Upstream provider, ASN	Low, but the provider is a fixed target
Compromised legitimate site	The site (owner cleans it)	Low — find another site
On-chain dead drop	Nothing	~$1.37 to point somewhere else

There is no abuse desk for a blockchain. The contract cannot be deleted by anyone but its owner, and updating where it points is cheaper than a cup of coffee.

"We blocked the C2 domain."

Which one? The implant asks the contract for a fresh address whenever it needs one. You blocked a value, not a source. The source is immutable, globally replicated, and reachable through any of a dozen public API providers.

The asymmetry nobody puts on the slide

Here is the part that cuts both ways, and it is the reason this is a detection story rather than a surrender story.

Reads are invisible on-chain. Writes are not. Every time the operator updates the payload pointer, that update is a transaction: permanently recorded, publicly readable, timestamped, and attributable to a contract address forever. GTIG could count twenty-plus updates over four months precisely because the operator's own tradecraft archived them. On-chain C2 gives the attacker takedown resistance and hands the defender a permanent, tamper-proof operational log. No conventional C2 offers that.

More usefully for anyone defending a network today: the implant still has to reach the chain. It does not run a full node. GTIG observed actors querying through centralised API providers — Binplorer, Blockchair, Blockcypher, Ethplorer — while Microsoft describes public RPC endpoints and third-party Web3 node infrastructure. Either way, the traffic is there on the wire.

And on a corporate finance workstation, a process that is not a browser opening a session to a Web3 node provider is not a false positive. It is the single most anomalous thing that endpoint will do all quarter. The indicator moved: it is no longer the C2 domain, which is disposable and unblockable. It is the shape of the resolution traffic, which the technique cannot discard without abandoning the technique.

ACR Stealer steals sessions, not just passwords

The second thing this campaign gets right — from the attacker's side — is what it takes.

• Chrome and Edge Login Data and Web Data databases, decrypted via DPAPI in the user's own context
• Live session tokens and cookies
• PDFs from Desktop and Downloads
• Microsoft 365 documents from synced OneDrive and SharePoint folders

No CVE is involved anywhere in this chain. Nothing is exploited. The user pastes a command, and both chains inherit exactly the privileges the signed-in user already has. That is why patch-centric programmes do not touch this class of intrusion at all, and why "we're fully patched" is an answer to a different question.

It also means the damage does not end when you remove the malware. A stolen session token is valid until it expires or is explicitly revoked — reimaging the laptop does not invalidate it. The attacker keeps the mailbox, the SharePoint tenant, and the SSO session while your incident ticket says "eradicated."

Remediation

This is not a patching problem, so the runbook is a hunting and revocation runbook.

1. Am I affected?

Start with the paste-and-run artefact. ClickFix leaves a fingerprint in RunMRU — the Run dialog history — and Microsoft published three advanced hunting queries for exactly this. Look for:

• DeviceRegistryEvents writes to RunMRU containing WebDAV paths or pushd
• rundll32.exe or mshta.exe with a parent of explorer.exe or cmd.exe, loading remote content
• Scheduled tasks created by PowerShell with names masquerading as updaters (Autoupdate, vendor-style names)
• pythonw.exe running from %LocalAppData%\Temp subdirectories such as LogiOptionsPlus
• Outbound HTTPS from non-browser processes to Web3 API providers or public blockchain RPC endpoints

Microsoft's antivirus signature for the second chain is Behavior:Win32/Interhta.Int; the IOC list in its report covers eight Chain-1 C2 domains (looksta[.]icu, contrite.quirksturdy[.]icu among them) and Chain-2 payload hosts including deep-harborio[.]com and auramatrixa[.]com. Treat those as starting points — they are the disposable half of the infrastructure.

2. Contain

• Block WebDAV egress (HTTP/HTTPS to DavWWWRoot, and the WebClient service outright if you do not use it — most enterprises do not)
• Restrict mshta.exe and rundll32.exe from launching internet-delivered content via ASR rules
• Deny non-browser processes outbound access to known Web3 API providers
• Clear RunMRU only after you have collected it as evidence

3. Hunt for compromise (ATT&CK)

Stage	Technique
Paste-and-run lure	T1204.004 Malicious Copy and Paste
rundll32 / mshta proxy execution	T1218.011, T1218.005
PowerShell / VBScript stages	T1059.001, T1059.005
JPEG payload concealment	T1027.003 Steganography
Scheduled-task persistence	T1053.005
On-chain C2 resolution	T1102.001 Dead Drop Resolver
Fiber-API shellcode execution	T1055 Process Injection
Browser credential theft	T1555.003, T1539
Exfiltration	T1041

4. Eradicate and — the step most teams skip — revoke

Removing the implant is the easy half. Because the payload is credentials and live sessions, eradication is incomplete until you:

• Revoke all refresh tokens and active sessions for every affected identity (in Entra ID, revoking sign-in sessions is a distinct action from a password reset — do both)
• Reset passwords for every credential stored in the affected browser profiles, not just the corporate one
• Audit for mailbox forwarding rules, OAuth app consents, and MFA methods registered during and after the intrusion window
• Re-check OneDrive and SharePoint access logs for bulk downloads from the compromised session

5. Verify

Confirm clean after revocation by watching for re-authentication attempts using the old tokens. Persistent failures from unfamiliar ASNs after a mass revocation are the confirmation that the tokens were live and are now dead.

Where this leaves detection

The uncomfortable conclusion of the EtherHiding trend is that indicator-based defence has a shrinking half-life. You cannot blocklist a smart contract into non-existence, and the operator re-points it for $1.37 whenever you burn an address. Every IOC in Microsoft's report is true, useful, and disposable.

What is not disposable is behaviour on the wire. The implant must resolve, must beacon, must stage, and must exfiltrate. This is the scenario Zero Hunt's AI Traffic Analysis was built for: a proprietary deep-learning model trained on billions of PCAP sequences, with four parallel inference heads — suspicious traffic, malware classification, attack type identification, and application fingerprinting — running on the appliance GPU, on-premise, with no cloud callback. It does not ask whether a destination is on a reputation list. It asks whether this host, which has never spoken this protocol to this class of endpoint before, is now doing so while staging and pushing data outbound. Blockchain-resolved C2 is invisible to reputation and loud to behaviour, which is precisely the trade the technique cannot avoid making.

The second half is validation. The reason ClickFix works is that the paste-and-run path is rarely tested — organisations test their patch level, not whether mshta.exe can still pull remote HTA content from a user desktop or whether WebDAV egress is actually blocked. Zero Hunt's 10-agent generative pentest swarm answers that empirically: the Exploit, Credential, and Post-Exploit agents run a per-environment chain in an ephemeral, gVisor-hardened container and report whether the path worked here, not whether a policy exists on paper. Every finding is ECDSA-signed, and change-triggered campaigns re-test when the environment shifts. The result is evidence about your own controls rather than an inherited assumption that the ASR rule you enabled in 2024 is still doing its job.

You cannot seize the contract. You can absolutely see the endpoint that talks to it.