Microsoft Sounds Alarm on Surge in ACR Stealer Attacks, Warns Customers of Sensitive Data Theft
A significant uptick in attacks using the ACR Stealer malware has been detected by Microsoft, with the threat actor targeting enterprise customers and stealing sensitive data such as browser-stored passwords, authentication tokens, and documents. Between late April and mid-June, the threat actor used a combination of social engineering tactics, WebDAV servers, and the MSHTA utility to deliver the info-stealing payload.
ACR Stealer is a malware-as-a-service (MaaS) operation that has been linked to the Amatera Stealer malware. The attacks typically begin with a ClickFix lure, which executes a command to run a malicious DLL from a remote WebDAV share using rundll32.exe. This tactic is not new and has been seen in previous attacks delivering malware such as Bumblebee and Voldemort.
Once the threat actor establishes communication with their command-and-control (C2) infrastructure, they execute a heavily obfuscated PowerShell script to launch a malware installer and establish persistence. The routine installs a bundled Python loader, creates a scheduled task masked as a software update, manipulates timestamps, clears PowerShell history, and injects the final payload into a system process for in-memory execution.
Some variants of ACR Stealer even use public blockchain services as dead-drop resolvers to obtain updated payload locations or C2 addresses. This technique is often referred to as “EtherHiding.” The malware then extracts an encrypted payload concealed inside a publicly hosted steganographic JPEG image and executes it directly in memory.
The ultimate goal of the ACR Stealer attacks remains the same: stealing sensitive data from web browsers, including passwords, cookies, session data, and authentication tokens. The malware can also decrypt browser data through the Windows Data Protection API DPAPI, access Chromium browser databases on Chrome and Edge, search for PDFs and Microsoft 365 documents, collect files from the Desktop and Downloads folders, and target enterprise-synchronized OneDrive and SharePoint directories.
Microsoft warns that these two campaigns are just a few of the most prevalent ACR Stealer delivery campaigns observed by Defender Experts. It’s likely that additional execution chains exist, making it essential for organizations to take proactive measures to defend against such attacks.
To mitigate the risk of ClickFix attacks, users should avoid copying and executing instructions in command interpreters when they claim to fix an error or verify their humanity. Organizations can reduce exposure to web-based delivery chains by enforcing filters, blocking low-reputation or new domains, and restricting access to online resources that are not required for business operations.
Application control rules can also be used to restrict launching content from a remote resource using tools like PowerShell, Python, mshta.exe, or rundll32.exe, especially from user-writeable paths. Microsoft’s report provides a list of recommended mitigations along with a set of indicators of compromise specific for the observed ACR Stealer activity.
As security teams often struggle to detect threats in their environment, it’s crucial to test every layer before attackers do. By doing so, organizations can ensure that their SIEM and EDR rules are effective in detecting and preventing such attacks.
Source: Bleeping Computer — 2026-07-18