CountLoader v3.2 Campaign Delivers ACR Stealer via Cracked Software Sites

Du'aine Davis

Observed in the wild

• A new malware campaign, active since mid-2025, targets users downloading cracked software, including Microsoft Office. It employs an upgraded CountLoader (v3.2) to deliver ACR Stealer, a credential theft tool. The infection chain begins with a trojanised Python library and ends with in-memory execution of a modified WinX_DVD_Pro.exe binary, avoiding disk writes and signature checks.
• Attackers leverage cracked software sites and MediaFire-hosted archives containing legitimate signed binaries with malicious modifications. CountLoader uses Mshta and PowerShell for fileless execution, XOR + Base64 for C2 communication, and persistence via scheduled tasks. It supports multiple task types, including payload delivery, removable media propagation, and PowerShell-based in-memory execution, indicating a sophisticated, modular design.
• Organisations should monitor for LOLBins abuse (Mshta, PowerShell, Certutil, Bitsadmin), anomalous scheduled tasks, and suspicious JWT-authenticated C2 traffic. Microsoft Defender users should enable advanced hunting queries for encoded HTA scripts, Base64/XOR patterns, and persistence artefacts like “GoogleTaskSystem136.*”. Enforce strict script execution policies, block cracked software sources, and deploy layered detection to counter fileless and signed binary abuse.

From Loader to Looter: ACR Stealer Rides on Upgraded CountLoader