ACR Stealer, OkoBot & Kratos PhaaS: OTX Pulse Analysis — Multi-Vector Credential Theft & RAT Campaigns

title: Potential ACR Stealer or OkoBot ClickFix Activity
description: Detects suspicious PowerShell execution patterns associated with ClickFix campaigns, including WebDAV interactions and base64 encoded commands.
status: experimental
date: 2026/07/17
references:
    - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-activity/
author: Security Arsenal
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'WebClient'
            - 'DownloadString'
    filter_webdav:
        CommandLine|contains: 'WebDAV'
    condition: selection and filter_webdav
falsepositives:
    - Administrative scripts
level: high
---
title: Suspicious Lua or AutoIt Script Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\autoit3.exe'
            - '\lua53.exe'
            - '\luac.exe'
            - '\wscript.exe'
    selection_parent:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\outlook.exe'
    condition: selection_img and selection_parent
date: 2026/07/17
level: high
tags:
    - attack.defense_evasion
    - attack.execution
---
title: GoSerpent Backdoor Process Activity
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\go.exe'
    selection_network:
        CommandLine|contains:
            - 'connect'
            - 'proxy'
    condition: selection and selection_network
date: 2026/07/17
level: critical

// Hunt for network connections to known malicious domains from OTX Pulses
let MaliciousDomains = dynamic([
    "proton-network.com", "strainedeasily.icu", "looksta.icu", "raidher.icu", 
    "apigrokcloud.icu", "deep-harborio.com", "zealpraxis.com", "prism-vertex.com",
    "taikei-rmc-co.biz", "allportcargoservice.com", "vilaribit.com",
    "coffeesaloon.online", "livewallpapers.online", "2baserec2.guru", "kbeautyreviews.com",
    "buenne.de", "enerdizerandtron.de", "ihrsupportcenter.de", "rundwasser.de",
    "sonnenbrillenspot.de", "abal.my", "starwellmedia.com"
]);
DeviceNetworkEvents
| where RemoteUrl in (MaliciousDomains) 
   or RemoteUrl has_any (".icu", ".online") // Broad heuristic for investigation
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by Count desc

<#
.SYNOPSIS
    IOC Hunt Script for ACR Stealer, OkoBot, and Associated Malware
.DESCRIPTION
    Checks running processes against known malicious hashes and hunts for registry keys
    associated with common persistence mechanisms found in these pulses.
#>

# Known Malicious Hashes from Pulses
$MaliciousHashes = @(
    "511ba918e1781ff38310530801b8cec5",
    "c029ceede8f8f8c8a4f58687e6681536fe4cc97b",
    "41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be",
    "2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279",
    "417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b",
    "ebffd5a76aaa690bcdb922f82e0bacc5",
    "b07d451ee65a1580f20a784c8f0e7a46",
    "187a1f68ae786e53d3831166dc84e6d2"
)

Write-Host "[*] Scanning running processes for known malicious hashes..." -ForegroundColor Cyan

$Processes = Get-Process
foreach ($Proc in $Processes) {
    try {
        $FilePath = $Proc.Path
        if ($FilePath -and (Test-Path $FilePath)) {
            $Hash = (Get-FileHash -Path $FilePath -Algorithm MD5).Hash.ToLower()
            if ($MaliciousHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS PROCESS FOUND: $($Proc.ProcessName) (PID: $($Proc.Id))" -ForegroundColor Red
                Write-Host "    Path: $FilePath"
            }
        }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[*] Checking for suspicious network connections to C2 domains..." -ForegroundColor Cyan

$Domains = @(
    "proton-network.com", "taikei-rmc-co.biz", "coffeesaloon.online", "kbeautyreviews.com"
)

$TCPConnections = Get-NetTCPConnection -State Established
foreach ($Conn in $TCPConnections) {
    try {
        $OwningProcess = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
        $RemoteAddress = $Conn.RemoteAddress
        
        # Resolve IP to Hostname to check against domain list
        $HostName = [System.Net.Dns]::GetHostEntry($RemoteAddress).HostName
        
        foreach ($Domain in $Domains) {
            if ($HostName -like "*$Domain*") {
                Write-Host "[!] SUSPICIOUS CONNECTION FOUND: $HostName ($RemoteAddress)" -ForegroundColor Red
                Write-Host "    Local Process: $($OwningProcess.ProcessName) (PID: $($OwningProcess.Id))"
            }
        }
    } catch {
        # Ignore resolution errors
    }
}

Write-Host "[*] Hunt complete."