ACR Stealer: Two observed intrusion chains amid increased threat activity
ACR Stealer malware campaigns using ClickFix lures to steal credentials from enterprise environments.
From late April to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity leveraging ClickFix social engineering to compromise enterprise environments. Two distinct intrusion chains were identified: one using WebDAV-delivered payloads with Python loaders and blockchain-backed C2, and another employing MSHTA and obfuscated PowerShell with steganography. Both campaigns target browser credentials, authentication tokens, and sensitive documents.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ACR Stealer campaigns observed between late April and mid-June 2026 succeeded primarily because users were manipulated through ClickFix social engineering tactics into executing malicious payloads delivered via WebDAV and MSHTA. This highlights how technically sophisticated delivery chains — including blockchain-backed C2, steganography, and obfuscated PowerShell — become highly effective when paired with human deception. The theft of browser credentials and authentication tokens can grant attackers persistent, privileged access to enterprise systems far beyond the initial compromise. Organizations that lack behavioral detection controls and user awareness programs are especially vulnerable to these multi-stage, living-off-the-land style attacks.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ACR Stealer
- malware — ClickFix
- malware — Amatera Stealer