Latrodectus & ACR Stealer Spread Via Auth Phishing

Cyble Research and Intelligence Labs (CRIL) reports a phishing site (googleaauthenticator.com) posing as Google Safety Centre that tricks users into downloading a signed loader (GoogleAuthSetup.exe) which decrypts and installs Latrodectus (a downloader) and ACR Stealer (an information stealer); the report includes technical analysis, IOCs (file hashes, C2 and config URLs, phishing domain), MITRE ATT&CK mappings, and recommended mitigations.