A Surge in ACR Stealer Attacks Leaves Microsoft Enterprise Customers Vulnerable
Microsoft has sounded the alarm on a significant increase in attacks using the ACR Stealer malware, which targets sensitive data stored on browsers and enterprise systems. Between late April and mid-June, threat actors exploited ClickFix social engineering tactics, WebDAV servers, and MSHTA utility to deliver the info-stealing payload to Microsoft’s enterprise customers.
ACR Stealer is a type of malware-as-a-service (MaaS) operation that has been linked to the Amatera Stealer malware. While multiple delivery methods are used, two intrusion chains stand out as the most prevalent for ACR Stealer. The first campaign begins with a ClickFix lure that executes a command to run a malicious DLL from a remote WebDAV share using rundll32.exe. This tactic is not new; threat actors have abused WebDAV in past attacks delivering malware like Bumblebee and Voldemort.
Once the initial payload is delivered, it establishes communication with the command-and-control (C2) infrastructure. A heavily obfuscated PowerShell script is then executed to launch a malware installer and establish persistence on the system. This includes installing a bundled Python loader, creating a scheduled task masked as a software update, manipulating timestamps, clearing PowerShell history, and injecting the final payload into a system process for in-memory execution.
Some variants of the malware use public blockchain services as dead-drop resolvers to obtain updated payload locations or C2 addresses. This technique, known as “EtherHiding,” allows attackers to mask their communication channels and evade detection. In some cases, the malware extracts an encrypted payload concealed inside a publicly hosted steganographic JPEG image and executes it directly in memory.
The ultimate goal of ACR Stealer is to steal sensitive data such as passwords, cookies, session data, authentication tokens stored on web browsers, and even decrypt browser data using the Windows Data Protection API (DPAPI). The malware also searches for PDFs and Microsoft 365 documents, collects files from the Desktop and Downloads folders, and targets enterprise-synchronized OneDrive and SharePoint directories.
Microsoft warns that these two campaigns are just a small part of the ACR Stealer delivery methods used by this malware family. To mitigate these attacks, organizations should enforce filters to reduce exposure to web-based delivery chains, block low-reputation or new domains, and restrict access to online resources not required for business operations.
Furthermore, application control rules can be implemented to restrict launching content from a remote resource using tools like PowerShell, Python, mshta.exe, or rundll32.exe. Microsoft’s report provides a comprehensive list of recommended mitigations along with specific indicators of compromise (IoCs) for the observed ACR Stealer activity.
In light of these findings, security teams must remain vigilant and proactive in their defense strategies. As Microsoft notes, “test every layer before attackers do.” By incorporating breach and attack simulation tests into their security protocols, organizations can strengthen their defenses and prevent threats from slipping through detection.
Source: Bleeping Computer — 2026-07-18