[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7r-Gj6zeaLlo2BQTJSzgBhusp1OIdYxg8oKcmJHe1bA":3},{"article":4,"iocs":46,"watch_terms":56,"solutions":57,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"fb6a49a2-7f92-4e35-8a84-1de473225ca9","ACR Stealer: Two observed intrusion chains amid increased threat activity","acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity-880977","From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments. The post ACR Stealer: Two observed intrusion chains amid increased threat activity appeared first on Microsoft Security Blog.","From late April to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity leveraging ClickFix social engineering to compromise enterprise environments. Two distinct intrusion chains were identified: one using WebDAV-delivered payloads with Python loaders and blockchain-backed C2, and another employing MSHTA and obfuscated PowerShell with steganography. Both campaigns target browser credentials, authentication tokens, and sensitive documents.","ACR Stealer malware campaigns using ClickFix lures to steal credentials from enterprise environments.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F07\u002F16\u002Facr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_Phishing-social-engineering.jpg","2026-07-16T23:12:02+00:00","2026-07-17T02:00:15.588658+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Defender","product",{"name":24,"type":22},"Microsoft Defender for Endpoint",{"name":26,"type":27},"WebDAV","technology",{"name":29,"type":27},"PowerShell","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,53],{"type":34,"value":48,"context":49},"ACR Stealer","Information-stealing malware family offered as MaaS, associated with rebranding of Amatera Stealer",{"type":34,"value":51,"context":52},"ClickFix","Social engineering lure technique used to trick targets into executing threat actor commands",{"type":34,"value":54,"context":55},"Amatera Stealer","Predecessor malware family rebranded as ACR Stealer",[18,21,24],{"controls":58,"vendors":138},[59,86,112],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":81,"vendor_name":18,"vendor_logo":82,"product_slug":83,"product_name":24,"url":84,"description":85},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":87,"name":88,"problem":89,"products":90},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[91,99,104],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":81,"vendor_name":18,"vendor_logo":82,"product_slug":100,"product_name":101,"url":102,"description":103},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":113,"name":114,"problem":115,"products":116},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[117,125,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":126,"product_name":127,"url":128,"description":129},"core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[139],{"slug":81,"name":18,"logo_path":82,"roles":140},[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":162},"acr-stealer-exploits-clickfix-social-engineering-to-harvest-enterprise-credentials","ACR Stealer Exploits ClickFix Social Engineering to Harvest Enterprise Credentials","The ACR Stealer campaigns observed between late April and mid-June 2026 succeeded primarily because users were manipulated through ClickFix social engineering tactics into executing malicious payloads delivered via WebDAV and MSHTA. This highlights how technically sophisticated delivery chains — including blockchain-backed C2, steganography, and obfuscated PowerShell — become highly effective when paired with human deception. The theft of browser credentials and authentication tokens can grant attackers persistent, privileged access to enterprise systems far beyond the initial compromise. Organizations that lack behavioral detection controls and user awareness programs are especially vulnerable to these multi-stage, living-off-the-land style attacks.",[147,148,149,150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 AT-2: Literacy Training and Awareness","MITRE ATT&CK T1204: User Execution","MITRE ATT&CK T1059.001: PowerShell","MITRE ATT&CK T1555.003: Credentials from Web Browsers","GDPR Article 32: Security of Processing",{}]