Microsoft warns of surge in ACR Stealer attacks on customers
Microsoft warns of surge in ACR Stealer malware attacks targeting enterprise customers via ClickFix and WebDAV delivery.
Microsoft has observed a significant surge in ACR Stealer malware attacks between late April and mid-June 2026, targeting enterprise customers to steal browser passwords, authentication tokens, and sensitive documents. The threat actor employs ClickFix social engineering, WebDAV servers, and MSHTA utility to deliver the info-stealing payload through two primary intrusion chains. ACR Stealer is believed to be a rebranded variant of Amatera Stealer and uses advanced evasion techniques including obfuscated PowerShell, blockchain dead-drop resolvers, and steganographic image embedding.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ACR Stealer campaign highlights how sophisticated social engineering (ClickFix lures) can bypass technical controls by manipulating users into executing malicious payloads themselves, rendering many perimeter defenses ineffective. Once deployed, the malware leverages living-off-the-land tools like MSHTA and obfuscated PowerShell to evade detection, while blockchain-based command-and-control resolvers make infrastructure takedowns extremely difficult. The theft of browser passwords and authentication tokens creates cascading risks including account takeover, lateral movement, and data exfiltration across the enterprise. This attack pattern underscores that untrained users remain the most exploitable vulnerability in any security architecture.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ACR Stealer
- malware — Amatera Stealer
- malware — Bumblebee
- malware — Voldemort