ACRStealer Exposed: How Cybercriminals Are Exploiting Google Docs for Malware Attacks

The Malware-as-a-Service (MaaS) Model Behind ACRStealer

Introduction

Cybersecurity threats have evolved beyond simple phishing scams and rudimentary malware. Today’s cybercriminals leverage sophisticated techniques, weaponising legitimate platforms to remain undetected while extracting valuable corporate and financial data. One of the latest and most concerning threats to emerge in 2025 is ACRStealer, an advanced information-stealing malware that uses Google Docs and Steam as part of its command-and-control (C2) infrastructure.

For C-Suite executives, the implications of ACRStealer extend far beyond individual security breaches. The ability to bypass traditional cybersecurity measures, compromise corporate credentials, and steal sensitive financial data poses a significant risk to organisations, with potential losses running into millions. This blog post provides a comprehensive breakdown of ACRStealer’s mechanisms, risks, and mitigation strategies tailored for senior leadership.

The Rise of ACRStealer: A Deep Dive

1. What is ACRStealer?

ACRStealer is an infostealer malware designed to extract sensitive information from infected systems, including:

• Antivirus identification – determining which security solutions are present to evade detection.
• Crypto wallet theft – targeting stored cryptocurrency assets.
• Login credentials theft – stealing usernames and passwords for financial services, corporate accounts, and personal data.
• Browser information extraction – harvesting stored passwords, cookies, and browsing history.
• File Transfer Protocol (FTP) credential theft – compromising access to cloud and remote servers.
• Text file harvesting – reading and extracting information from text documents.

While information stealers are not new, ACRStealer stands out due to its stealth tactics, sophisticated distribution, and abuse of legitimate cloud platforms.

2. The Distribution Tactics of ACRStealer

The primary distribution method of ACRStealer involves software cracks and keygens—tools commonly used for pirated software. Cybercriminals embed the malware into files disguised as:

• Cracked versions of premium software (e.g., Microsoft Office, Adobe Photoshop).
• Keygens that generate activation keys for licensed software.
• Fake updates for widely used applications.

Once downloaded, the malware silently executes in the background, harvesting data while remaining undetected.

For businesses, the presence of shadow IT—employees downloading unauthorised software—presents a major risk. Even a single compromised device within a corporate network could lead to catastrophic data breaches.

The Stealth Factor: How ACRStealer Evades Detection

1. Dead Drop Resolver (DDR): The Secret to ACRStealer’s Success

Traditional malware relies on hard-coded C2 server addresses, making it easier for cybersecurity teams to detect and block them. ACRStealer, however, employs Dead Drop Resolver (DDR) tactics to communicate with its C2 infrastructure dynamically.

Instead of embedding a static C2 address, ACRStealer retrieves its C2 domain from legitimate platforms like:

• Google Docs
• Steam Discussions
• Pastebin

Cybercriminals update a simple text document hosted on these platforms, which the malware reads to determine the current C2 address. If one server is seized or blocked, the attacker simply updates the Google Doc or Steam page, allowing the malware to reconnect without requiring changes to the malware itself.

2. Why This is Alarming for Businesses

• Bypasses Firewalls and Security Solutions: Most organisations do not block Google Docs or Steam, making these legitimate services ideal for covert malware communication.
• Dynamic and Resilient: Unlike traditional malware, which can be rendered useless once its C2 infrastructure is identified, ACRStealer remains agile by frequently updating its C2 links.
• Lower Detection Rates: Security solutions often overlook outbound connections to Google Docs, allowing the malware to exfiltrate data undetected.

For C-Suite executives, the business impact is clear: corporate data, credentials, and financial assets are at risk without triggering traditional security alerts.

Business Risks and Financial Implications

1. The Cost of an ACRStealer Breach

The financial and operational impact of a data breach due to ACRStealer can be devastating:

• Loss of Corporate Credentials → Unauthorised access to bank accounts, client databases, and cloud storage.
• Compromised Customer Data → Potential GDPR and regulatory violations, leading to legal penalties.
• Insider Threats and Espionage → Leaked business-critical information can be exploited by competitors or cybercriminals.
• Identity Theft Risks → Stolen personal data of executives and employees can be sold on dark web marketplaces.
• Ransomware Risks → Stolen credentials could lead to further exploitation, including ransomware attacks.

2. The Role of Malware-as-a-Service (MaaS)

Like many modern malware families, ACRStealer is offered as Malware-as-a-Service (MaaS). This means that any cybercriminal can rent or purchase access to the malware infrastructure, making attacks cheap, scalable, and difficult to trace.

The availability of ACRStealer on hacker forums ensures that even low-skilled cybercriminals can launch attacks, increasing the risk of widespread breaches.

Mitigating the ACRStealer Threat: A C-Suite Cybersecurity Strategy

While ACRStealer is a formidable threat, proactive cybersecurity strategies can significantly reduce the risk of infection.

1. Implement a Robust Cyber Hygiene Culture

• Strict Software Policies → Ban the use of unauthorised software downloads and enforce software whitelisting.
• Zero Trust Architecture → Limit access privileges and enforce identity verification for critical systems.
• Regular Employee Cybersecurity Training → Educate staff on the risks of software cracks and phishing scams.

2. Strengthen Endpoint and Network Security

• Deploy Advanced Endpoint Detection and Response (EDR) Solutions → AI-powered threat detection can help identify unusual outbound connections to Google Docs.
• Monitor Network Traffic for Anomalies → Track unusual outbound requests to cloud platforms and enforce traffic analysis tools.
• Implement DNS Filtering and URL Blocking → Block known malicious URLs, including pirated software sources.

3. Enforce Strong Authentication and Encryption

• Mandate Multi-Factor Authentication (MFA) → Even if credentials are stolen, MFA acts as an additional security layer.
• Use Hardware Security Modules (HSMs) → Protect crypto wallets and financial assets from unauthorised access.
• Encrypt Sensitive Business Data → Ensure data at rest and in transit is encrypted to prevent easy exfiltration.

4. Incident Response and Cyber Threat Intelligence

• Regular Threat Hunting → Conduct proactive searches for ACRStealer indicators of compromise (IoCs).
• Cyber Threat Intelligence Feeds → Subscribe to intelligence sources to stay ahead of emerging threats.
• Implement Rapid Response Plans → Ensure that your SOC (Security Operations Centre) is equipped to respond to an ACRStealer breach swiftly.

Cloud Access Security Brokers (CASB) and ACRStealer: Strengthening Enterprise Security

As organisations increasingly adopt cloud-based applications for business operations, the role of Cloud Access Security Brokers (CASBs) has become critical in securing cloud environments. With the emergence of advanced information stealers like ACRStealer, which exploits legitimate cloud platforms such as Google Docs and Steam, organisations need proactive measures to detect and mitigate these threats.

This section explores how CASBs can help combat ACRStealer, providing C-Suite executives with insights into how these solutions can protect business data and mitigate the risk of sophisticated cyber threats.

Understanding CASBs: The First Line of Defence in Cloud Security

A Cloud Access Security Broker (CASB) is a security solution that acts as an intermediary between users and cloud services, providing visibility, compliance enforcement, threat protection, and data security. CASBs help organisations:

• Monitor and control cloud usage to detect unauthorised access and shadow IT.
• Enforce security policies to prevent data leakage and credential theft.
• Detect anomalies and malicious activity in cloud applications and SaaS platforms.

With ACRStealer leveraging Google Docs as a Dead Drop Resolver (DDR), CASBs offer a crucial layer of defence by detecting and mitigating unauthorised or suspicious activity involving cloud services.

How CASBs Can Help Combat ACRStealer

1. Detecting Anomalous Cloud Access

Since ACRStealer uses Google Docs to retrieve its C2 domain, a CASB solution can monitor cloud activity to identify:

• Unusual outbound traffic to Google Docs and Steam Discussions from non-standard business applications.
• Multiple access attempts from unusual locations or IP addresses linked to malware activity.
• Excessive data exfiltration from cloud storage, which may indicate information theft.

Example: CASB in Action

A CASB solution flags an employee’s device making repeated, automated requests to a shared Google Doc at irregular intervals. Security teams investigate and find ACRStealer exfiltrating corporate credentials via the document.

2. Enforcing Policy-Based Access Controls

CASBs allow enterprises to implement granular access controls for cloud applications. By defining strict policies, organisations can:

• Block unauthorised file-sharing activities that may facilitate malware communication.
• Restrict access to personal cloud storage accounts from corporate networks.
• Prevent unapproved downloads of files from Google Docs, Steam, and other cloud platforms.

Example: Preventing Malicious Communications

A CASB policy prevents corporate devices from accessing personal Google accounts, ensuring that malware cannot retrieve Dead Drop Resolver links from an attacker’s Google Doc.

3. Strengthening Data Loss Prevention (DLP)

ACRStealer harvests credentials, crypto wallets, and sensitive files from infected systems. A CASB with integrated DLP capabilities can:

• Monitor file transfers and prevent unauthorised data movement to unapproved cloud services.
• Detect and block credential sharing within cloud-based collaboration tools.
• Identify sensitive corporate data exfiltration triggered by malware activity.

Example: Blocking Information Theft

A CASB solution detects login credentials being uploaded to an unknown Google Doc, triggering an automated security response to block the exfiltration.

4. Enhancing Threat Intelligence and Malware Detection

CASBs integrate with enterprise threat intelligence to identify and block known malware C2 servers and suspicious activities linked to infostealers. By leveraging machine learning and behavioural analytics, CASBs can:

• Identify ACRStealer’s malicious behaviour even if it uses new C2 domains.
• Correlate security events across cloud applications to detect potential insider threats.
• Flag attempts to upload or access malicious scripts disguised as legitimate documents.

Example: Threat Intelligence in Action

A CASB solution detects that a corporate user is accessing a Google Doc previously flagged in a global threat database as an ACRStealer communication hub. The security team is alerted, and access is immediately revoked.

5. Enforcing Zero Trust Cloud Security

To mitigate ACRStealer’s threat, organisations must adopt a Zero Trust approach, where access is strictly verified and monitored. CASBs help enforce:

• Continuous authentication and identity verification before allowing access to cloud resources.
• Session controls that limit privileged access based on real-time security posture.
• Multi-Factor Authentication (MFA) enforcement for high-risk applications.

Example: Stopping Credential Abuse

An attacker attempts to use stolen credentials from ACRStealer to log into a company’s financial SaaS platform. A CASB-enforced Zero Trust policy detects the login from an unusual location and device, prompting an MFA challenge that the attacker fails. Access is blocked.

C-Suite Takeaways: Why CASBs Are Essential for ACRStealer Defence

1. Strengthen Cloud Security Posture

CASBs provide enterprise-wide visibility into cloud usage and threats, ensuring that malware cannot operate undetected within cloud services.

2. Reduce the Risk of Data Exfiltration

By monitoring and restricting cloud interactions, CASBs prevent sensitive information from being stolen by ACRStealer or other infostealers.

3. Mitigate Shadow IT and Unauthorised Access

CASBs eliminate security gaps caused by employees using personal cloud services, reducing the risk of malware infiltration.

4. Proactively Detect and Block Cyber Threats

With threat intelligence and machine learning, CASBs identify emerging malware tactics, preventing infostealer-related breaches before they escalate.

5. Enforce Compliance and Regulatory Requirements

For industries with strict data protection regulations, CASBs help ensure that corporate cloud security remains compliant with GDPR, ISO 27001, and other frameworks.

Detecting and Mitigating ACRStealer with VAPT, Malware Analysis, and Reverse Engineering

To effectively counter ACRStealer, a sophisticated infostealer that exploits legitimate platforms like Google Docs and Steam, organisations must deploy comprehensive cybersecurity measures. Three critical techniques that aid in detecting, analysing, and mitigating such threats are:

1. Vulnerability Assessment and Penetration Testing (VAPT)
2. Malware Analysis
3. Reverse Engineering

Each of these methodologies plays a crucial role in identifying security gaps, understanding malware behaviour, and proactively mitigating risks. This section provides a detailed breakdown of how these techniques apply to ACRStealer.

1. Vulnerability Assessment and Penetration Testing (VAPT) Against ACRStealer

What is VAPT?

VAPT is a proactive security testing approach that helps identify vulnerabilities in IT infrastructure, applications, and networks before cybercriminals exploit them. It consists of two components:

• Vulnerability Assessment (VA): Automated scanning of systems to detect misconfigurations, weak passwords, outdated software, and security flaws that could be exploited.
• Penetration Testing (PT): Ethical hackers simulate real-world cyberattacks to assess how well systems can withstand malware intrusions and data breaches.

How VAPT Helps Detect and Mitigate ACRStealer

1. Identifying Unauthorised Cloud Communications

• VAPT tests network traffic to detect abnormal outbound connections to Google Docs or Steam, which ACRStealer uses for Dead Drop Resolver (DDR) communication.
• Identifying unusual domain name requests or DNS tunnelling activity can flag infected systems.

2. Detecting Exploitable Entry Points

• Since ACRStealer is distributed via cracked software and keygens, VAPT audits software repositories and endpoints to detect risky downloads.
• Security misconfigurations in endpoints, such as unprotected admin privileges, are identified and remediated.

3. Testing Endpoint Security Controls

• VAPT evaluates the effectiveness of existing security controls, such as firewalls, antivirus, and Endpoint Detection and Response (EDR) solutions, in detecting and blocking ACRStealer.
• By simulating credential-stealing malware, penetration testers can validate the ability of security solutions to detect and respond to threats.

4. Strengthening Authentication and Access Controls

• ACRStealer harvests login credentials stored in browsers and FTP clients. VAPT tests the security of authentication mechanisms, ensuring the implementation of:
  • Multi-Factor Authentication (MFA)
  • Password encryption and storage best practices
  • Least Privilege Access Control (LPAC)

Real-World VAPT Use Case

A penetration tester discovers that corporate endpoints allow unrestricted access to Google Docs from unmonitored accounts. This security gap enables ACRStealer to retrieve its C2 domain via DDR without triggering alerts. The company then enforces strict CASB policies and outbound firewall rules to prevent unauthorised access.

2. Malware Analysis: Understanding ACRStealer’s Behaviour

What is Malware Analysis?

Malware analysis involves studying malicious software to understand:

• How it infects systems
• What data it steals
• How it communicates with cybercriminals
• Its persistence mechanisms

How Malware Analysis Helps Combat ACRStealer

1. Dynamic Analysis: Observing ACRStealer in Action

• Cybersecurity researchers execute ACRStealer in a controlled environment (sandbox) to observe:
  • File modifications and registry changes
  • Network connections to Google Docs and Steam
  • Process injections and credential harvesting activities

2. Static Analysis: Examining the Malware Code

• Analysing ACRStealer’s executable files and scripts helps security teams identify:
  • Hardcoded strings containing domain names, API calls, or encryption keys.
  • Indicators of Compromise (IOCs) that can be used for threat detection.

3. Extracting and Blocking Command and Control (C2) Communications

• By studying ACRStealer’s communication techniques, analysts can pre-emptively block:
  • Specific Google Docs URLs used as DDR sources
  • IP addresses of known C2 servers
  • Encrypted traffic patterns that indicate exfiltration attempts

Real-World Malware Analysis Use Case

A security team detects an employee’s device making repeated calls to docs.google.com at odd intervals. Upon analysis, they discover that the device is infected with ACRStealer, using a shared Google Doc to obtain its C2 domain. The security team then:

• Deletes the malicious Google Doc
• Implements firewall rules to block future attempts
• Notifies Google to take down attacker-controlled documents

3. Reverse Engineering: Dissecting ACRStealer’s Code

What is Reverse Engineering?

Reverse engineering is the process of disassembling and deconstructing malware to understand its inner workings. This technique is used by cybersecurity experts to:

• Identify encryption techniques used for data exfiltration
• Uncover hidden capabilities of the malware
• Create patches or detection signatures to prevent future infections

How Reverse Engineering Helps Detect and Mitigate ACRStealer

1. Extracting and Analysing ACRStealer’s Code

• Security analysts use tools like IDA Pro and Ghidra to decompile ACRStealer’s executable.
• They study function calls to understand:
  • How ACRStealer steals credentials from web browsers and FTP clients.
  • The encryption algorithm used for stolen data transmission.
  • Methods used to evade antivirus detection.

2. Discovering New Variants of ACRStealer

• Reverse engineering allows security researchers to detect code similarities between malware strains, helping identify and neutralise new ACRStealer variants before they spread widely.

3. Generating Threat Intelligence Feeds

• Extracted malicious signatures are shared with security platforms to update antivirus and EDR solutions.
• This helps enterprises detect ACRStealer infections proactively.

Real-World Reverse Engineering Use Case

After reverse engineering a sample of ACRStealer, researchers discover a hidden self-delete function that wipes traces of infection after exfiltrating data. This insight helps security teams develop better forensic tools to detect stealthy infections before they disappear.

C-Suite Takeaways: A Multi-Layered Defence Strategy

1. Implement a Robust VAPT Programme

• Conduct regular penetration testing to detect vulnerabilities before ACRStealer exploits them.
• Strengthen endpoint security against credential theft and data exfiltration.

2. Leverage Malware Analysis for Early Detection

• Deploy sandboxing solutions to study malware behaviour in a controlled environment.
• Identify and block attacker-controlled Google Docs URLs used for C2 communications.

3. Use Reverse Engineering to Uncover Evolving Threats

• Deconstruct malware samples to develop detection signatures and security patches.
• Enhance threat intelligence sharing across security networks.

4. Adopt a Zero Trust Security Framework

• Enforce strict access controls and continuous monitoring of cloud communications.
• Deploy CASB solutions to detect and block unauthorised access to Google Docs and Steam.

5. Strengthen User Awareness and Endpoint Protection

• Educate employees about the dangers of downloading cracked software.
• Deploy anti-malware solutions with real-time behavioural analysis.

Final Thoughts: The Offensive Security approach

The fight against ACRStealer requires a multi-layered cybersecurity approach. By leveraging VAPT, malware analysis, and reverse engineering, enterprises can detect, understand, and mitigate this emerging threat before it causes financial and reputational damage.

For C-Suite executives, investing in advanced cybersecurity solutions and skilled security teams is not just an IT concern—it’s a business imperative.

The Future of Cloud Security Against Infostealers

As cyber threats evolve, CASBs will play an increasingly vital role in securing cloud environments against malware like ACRStealer. By providing real-time visibility, adaptive threat protection, and policy enforcement, CASBs empower enterprises to defend against sophisticated cyber threats.

ACRStealer exemplifies the evolution of cyber threats, blending social engineering, sophisticated stealth techniques, and legitimate cloud services to infiltrate organisations undetected.

For C-Suite executives, the message is clear: Traditional cybersecurity measures are no longer enough. Companies must adopt a multi-layered approach, combining technology, policies, and continuous education to counteract modern cyber threats effectively.

By prioritising cybersecurity at the highest levels, organisations can not only mitigate risks but also safeguard their reputation, financial assets, and operational integrity in an increasingly hostile digital landscape.

For C-Suite executives, investing in a CASB solution is not just about mitigating risk—it is about ensuring business continuity, protecting intellectual property, and securing financial assets in an era where cloud-based threats are more sophisticated than ever.

Key Action Items for C-Suite Leaders:

✔️ Deploy a CASB solution to gain full visibility into cloud security.

✔️ Enforce strict access controls to prevent malware from exploiting cloud services.

✔️ Leverage threat intelligence to detect and block malicious cloud activity.

✔️ Adopt a Zero Trust approach to prevent unauthorised credential use.

✔️ Educate employees on safe cloud usage to mitigate security risks.

By integrating CASBs into enterprise cybersecurity strategies, organisations can proactively defend against emerging threats like ACRStealer, ensuring their cloud infrastructure remains secure, compliant, and resilient.

Take Action Today

✔ Review your organisation’s cyber hygiene policies

✔ Strengthen endpoint and network security measures

✔ Invest in employee awareness training

✔ Implement Zero Trust security models

✔ Stay informed and proactively hunt for threats

The fight against ACRStealer and its variants is just beginning—will your organisation be prepared?