Microsoft has issued a warning regarding a significant increase in attacks leveraging the ACR Stealer malware, which targets enterprise customers to pilfer browser-stored passwords, authentication tokens, and sensitive documents. The observed surge in activity occurred between late April and mid-June, with threat actors employing social engineering tactics, WebDAV servers, and the MSHTA utility to deliver the information-stealing payload.
ACR Stealer is believed to be a rebranded version of the Amatera Stealer malware, operating as a malware-as-a-service (MaaS) offering. Microsoft has identified two primary intrusion chains as the most prevalent delivery methods for ACR Stealer.
The first campaign begins with a "ClickFix" social engineering lure. This method prompts users to execute a command that runs a malicious DLL from a remote WebDAV share via `rundll32.exe`. Threat actors commonly abuse WebDAV, often using GUID-based directory structures and filenames, such as "google.ct," to mimic legitimate resources and blend with normal network traffic. After establishing communication with its command-and-control (C2) infrastructure, a heavily obfuscated PowerShell script is executed. This script launches a malware installer, establishes persistence by installing a bundled Python loader, creates a scheduled task disguised as a software update, manipulates timestamps, clears PowerShell history, and injects the final payload into a system process for in-memory execution. Some variants of this chain utilize public blockchain services as dead-drop resolvers to obtain updated payload locations or C2 addresses, a technique known as EtherHiding.
In the second delivery chain, the ClickFix lure is used to launch MSHTA (Microsoft HTML Application Host). MSHTA then retrieves malicious content from the attacker's server and executes an obfuscated PowerShell downloader. This downloader extracts an encrypted payload hidden within a publicly hosted steganographic JPEG image and executes it directly in memory.
Despite their differences, both campaigns share the same objective: to steal sensitive data. This includes passwords, cookies, session data, and authentication tokens stored in web browsers. The malware decrypts browser data using the Windows Data Protection API (DPAPI), accesses Chromium browser databases (including those for Chrome and Edge), searches for PDF and Microsoft 365 documents, and collects files from Desktop and Downloads folders. It also specifically targets enterprise-synchronized OneDrive and SharePoint directories. All collected data is then archived for exfiltration to the attacker.
Microsoft's Defender Experts observed these two campaigns as the most common, but the company warns that additional execution chains for the ACR Stealer family likely exist.
To defend against ClickFix attacks, users are advised to avoid copying and executing instructions in command interpreters, especially when prompted to "fix an error" or "verify humanity." Organizations should reduce exposure to web-based delivery chains by implementing filters, blocking low-reputation or new domains, and restricting access to online resources not essential for business operations. Application control rules can also be used to restrict the launching of content from remote resources by tools like PowerShell, Python, `mshta.exe`, or `rundll32.exe`, particularly from user-writable paths. Microsoft has provided a comprehensive list of recommended mitigations and indicators of compromise specific to the observed ACR Stealer activity.
