Skip to content
Threat Note Threat Note

Aggregating Cyber Insights

  • Articles
  • Breaches
  • Learning
  • News
  • Podcast
  • Research
  • Toolkit
  • Vulnerabilities
  • Webinars
  • About Us
  • Home
  • News
  • From Cyber Security News – ACRStealer Malware Exploiting Google Docs as C2 To Steal Login Credentials
From Cyber Security News – ACRStealer Malware Exploiting Google Docs as C2 To Steal Login Credentials
Posted inNews

From Cyber Security News – ACRStealer Malware Exploiting Google Docs as C2 To Steal Login Credentials

Posted by shaikh Saqib February 21, 2025

 A newly identified malware variant dubbed ACRStealer has been observed leveraging Google Docs as a command-and-control (C2) server to bypass traditional security defenses and harvest sensitive login credentials. This sophisticated attack vector exploits the trusted reputation of Google’s infrastructure to evade detection, marking a significant escalation in credential-theft campaigns. Cybersecurity firm ThreatSec disclosed the campaign
The post ACRStealer Malware Exploiting Google Docs as C2 To Steal Login Credentials appeared first on Cyber Security News. Read More

Tags:
ACRStealer malwareAES-256-CBC encryption flawAPI activity monitoringBase64-encoded payload executionbrowser traffic obfuscationcredential theft campaigncyber awarenesscyber defensecyber espionage tacticscyber protectioncyber threat intelligencecybersecuritycybersecurity newsdata breachesdigital privacyenterprise account compromiseenterprise security best practicesfinancial sector cyber threatGoogle Docs C2 abuseGoogle Drive API misuseGoogle Forms data exfiltrationGoogle Workspace security measures.hackinghacking newshealthcare cybersecurity riskinfosecinfosec newsMFA enforcementmulti-stage payload retrievalnetwork securitynoteOAuth 2.0 exploitationonline securityphishing document attacksproactive threat-huntingPython malware scriptsecurity perspectivesecurity updatesthreatthreat intelligencethreat notethreatnote
Last updated on February 24, 2025

Latest Posts

  • From The Hacker News – cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch NowMay 9, 2026
  • From The Hacker News – cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch NowMay 9, 2026
  • From Cyber Security News – TCLBANKER Malware Targets Users Through Self-Propagating WhatsApp and Outlook Worm ModulesMay 9, 2026
  • From Cyber Security News – NVIDIA Data Breach Reportedly Exposes Personal Information of GeForce UsersMay 9, 2026
  • From Cyber Security News – Let’s Encrypt Halts Certificate Issuance After Cross-Signed Root Certificate IncidentMay 9, 2026
Total Visitors
1505217

Archives

  • May 2026
  • April 2026
  • March 2026
  • February 2026
  • January 2026
  • December 2025
  • November 2025
  • October 2025
  • September 2025
  • August 2025
  • July 2025
  • June 2025
  • May 2025
  • April 2025
  • March 2025
  • February 2025
  • January 2025
  • December 2024
  • November 2024
  • October 2024
  • September 2024
  • August 2024
  • July 2024
  • June 2024
  • May 2024
  • April 2024
  • March 2024
  • February 2024
  • January 2024
  • December 2023
  • November 2023
  • October 2023
  • September 2023
  • August 2023
  • July 2023
  • June 2023
  • May 2023
  • April 2023
  • February 2023
  • December 2022
  • November 2022
  • May 2022
Copyright 2026 — Threat Note. All rights reserved. Bloghash WordPress Theme
Scroll to Top