Digital Deceit: How ACRStealer Hacked the Trust Behind Google Docs

In February 2025, researchers uncovered a sophisticated new infostealer known as ACRStealer, which is abusing trusted platforms like Google Docs, Steam, and telegraph as covert command-and-control (C2) channels . As a pen tester, this signals a stark evolution: adversaries are now weaponizing legitimate services to slip past traditional defenses. Here’s an in-depth breakdown, and why real-world pentesting methods must adapt.

🚨 What Is ACRStealer , And Why It Matters

ACRStealer is a credential-thieving malware that uses stolen or cracked software installers to infect victim systems. Once inside, it deploys a multi-stage payload to harvest:

Browser credentials and cookies
Cryptocurrency wallets and FTP/VPN credentials
Text files, chat logs, email, remote-access tokens
Password manager vaults and database credentials

It then compresses the stolen data and exfiltrates it to attacker infrastructure. With over 12,000 compromised enterprise accounts across sectors like finance and healthcare, ACRStealer poses a major organizational risk

Why it’s a pentesting concern: This infostealer bypasses signature-based detection and hides in plain sight. Traditional pen tests may miss such threats entirely.

Hybrid C2 via “Dead Drop Resolver”

ACRStealer doesn’t hardcode its C2 server; instead, it reads the address from live documents hosted on trusted platforms using a technique called Dead Drop Resolver (DDR)

How DDR Works:

Malware fetches a public Google Doc, Steam page, or telegra.ph link.
It decodes a Base64-embedded C2 domain.
Malware connects to that C2 server to download encrypted config and exfiltrate data.

Use of Google Docs allows attackers to evade URL filtering, network monitoring, and firewall-based defenses

Current Capabilities & Impact

Dynamic C2 updates – Attackers can change the C2 simply by editing the document. No new malware binaries needed
Targeted sectors – Finance, healthcare, e-commerce, and military-affiliated targets have already been hit .
Broad payload reach – From VPN tokens to browser cookies, the range of stolen assets is extensive

Penetration Testing Insights

1. Simulating Legitimate C2 Channels

Include scenarios where malware-like agents fetch live C2 via Google Docs or Steam. Monitor for unexpected outbound calls to trusted cloud services using traffic analysis and sandboxing.

2. Shadow IT & Cracked Software Risk

Audit endpoints for unapproved software installations. Ensure hosts are restricted from running executables from “Downloads” or external sources.

3. Network Behavior Profiling

Measure baseline traffic patterns to services like docs.google.com. Alert on anomalies—high frequency, odd timing, or large payload sizes.

4. C2 URL Monitoring

Identify documents or domains similar to known ACRStealer samples. Craft mock payloads in isolated C2 docs to test endpoint detection.

5. Test MFA & Credential Throttling

Simulate credential theft from browsers or local config files. Evaluate effectiveness of multi-factor authentication and session protection mechanisms.

AI-Powered Theft Meets Human Weakness

ACRStealer exemplifies a broader trend: AI-driven credential exfiltration meets human lapses.

AI-enhanced infostealers can parse browser cache or decode steganographic exfil.
Social engineering enables the initial drop (e.g. pirated software).
Human-in-the-loop remains the weakest link—employees install cracked apps, click unsolicited links.

State-sponsored Echoes in C2 Techniques

State-linked groups (e.g., from China, Russia) have previously exploited trusted infrastructure for C2. ACRStealer’s adoption of DDR echoes tactics we've seen in supply chain operations and silent espionage.

Pen testers simulating these threats should pivot toward emulating cross-service fallback chains—primary C2 → secondary cloud channels.

Ransomware & ACRStealer: A Dangerous Alliance

Stolen credentials are valuable to ransomware gangs as entry points into networks. ACRStealer could be the reconnaissance stage, followed by ransomware deployment.

Pen test tip: Chain an ACRStealer simulation into a red-team ransomware path. See if network segmentation and EDR controls catch it.

Supply Chain and Cloud Safety

ACRStealer’s use of Google Docs underscores vulnerabilities in trusted cloud ecosystems.

Supply chain integrity must consider cloud APIs as exploitation vectors.
Pen testers should include cloud API abuse scenarios, not just perimeter attacks.

Actionable Pen Testing Strategies

Strategy	Technique
Target Google Docs C2	Use Burp/Nmap to simulate benign C2 lookups via API calls
Simulate infostealer behavior	Inject fake exfil via HTTP(s) to Google Forms endpoint
Assess endpoint hygiene	Use Shodan to search for public devices with unmanaged endpoints
Test file execution policies	Attempt running scripts from Downloads and cracked software directories
VPN/security bypass testing	Fingerprint VPN clients; escalate to lateral movement using stolen creds
Phishing + Docs combos	Send Doc-based invites + payloads; measure spawns

Defense Upgrade Recommendations

Endpoint Hardening: Whitelist software; block execution from untrusted paths.
Traffic Monitoring: Flag anomalous calls to docs.google.com or steamcdn.net.
Cloud DLP & CASB: Detect credential exfil in forms or doc comments.
User Awareness: Train staff on dangers of cracked software and hidden C2 sneaks.
EDR Calibration: Ensure live behavior detection triggers on credential scraping.
Pentest Cloud C2 Channels: Include live doc-based simulations in red-team exercises.

Why Shift Pentesting Now?

ACRStealer marks a tectonic shift. No longer is patching or perimeter monitoring enough attackers live off the land within trusted services. As pen testers, it’s time for living-off-the-land (LOTL) C2 scenarios baked into default playbooks.

Expert Insight

James Knight, Senior Principal at Digital Warfare, observes:“Penetration testing must start simulating real adversary tactics if one can't emulate live-cloud C2 channels, you're flying blind.”

Compliance & Policy Implications

SOC 2 / ISO 27001: Must now cover cloud API misuse
GDPR: Data exfil via Docs is subject to breach notification laws
ITAR/NIST: Government sectors must inventory allowed C2 services

Human Focus

Don't forget the human edge:

Run phishing campaigns that lure users into Google Docs invites
Train analysts to review OAuth authorizations for unusual scopes
Simulate social engineering that encourages doc downloads

Conclusion & Call to Action

ACRStealer's innovative use of Google Docs as a stealth C2 channel demands urgent attention from pentesters. Model attacks using real-world channels, detect subtle credential-stealing behavior, and enforce strict endpoint/cloud hygiene.

Whether you're a pen tester, red‑teamer, or SOC leader, this is a pivot point. Start integrating DDR scenarios into annual pen tests, educate your teams, and elevate detection of cloud‑based C2. Stay ahead or get caught in the wake of modern infostealer campaigns.

Search This Blog

CyberPro