[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frXst5tsX7gDB2IS0JBBUS_VXXzsXMbfdRWYQ0cCBfh8":3},{"article":4,"iocs":46,"watch_terms":58,"solutions":59,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"abdf45e7-003b-4b4d-bc72-e7c30a60d60a","Microsoft warns of surge in ACR Stealer attacks on customers","microsoft-warns-of-surge-in-acr-stealer-attacks-on-customers-3198a5","Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers. [...]","Microsoft has observed a significant surge in ACR Stealer malware attacks between late April and mid-June 2026, targeting enterprise customers to steal browser passwords, authentication tokens, and sensitive documents. The threat actor employs ClickFix social engineering, WebDAV servers, and MSHTA utility to deliver the info-stealing payload through two primary intrusion chains. ACR Stealer is believed to be a rebranded variant of Amatera Stealer and uses advanced evasion techniques including obfuscated PowerShell, blockchain dead-drop resolvers, and steganographic image embedding.","Microsoft warns of surge in ACR Stealer malware attacks targeting enterprise customers via ClickFix and WebDAV delivery.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-warns-of-surge-in-acr-stealer-attacks-on-customers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F06\u002F18\u002Fhand.jpg","2026-07-18T14:17:19+00:00","2026-07-18T16:00:16.688439+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft Defender","product",{"name":24,"type":25},"WebDAV","technology",{"name":27,"type":25},"MSHTA",{"name":29,"type":25},"PowerShell",{"name":31,"type":32},"ACR Stealer Campaign","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,41],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,53,56],{"type":37,"value":48,"context":49},"ACR Stealer","Info-stealing malware-as-a-service targeting browser data, credentials, and documents",{"type":37,"value":51,"context":52},"Amatera Stealer","Original malware believed rebranded as ACR Stealer",{"type":37,"value":54,"context":55},"Bumblebee","Historical malware using similar WebDAV delivery tactics",{"type":37,"value":57,"context":55},"Voldemort",[18,21],{"controls":60,"vendors":144},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":91,"name":92,"problem":93,"products":94},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":112,"vendor_name":18,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":119,"name":120,"problem":121,"products":122},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[123,129,136],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":125,"url":127,"description":128},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":133,"url":134,"description":135},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[145],{"slug":112,"name":18,"logo_path":113,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":167},"acr-stealer-surge-exploits-social-engineering-to-harvest-enterprise-credentials","ACR Stealer Surge Exploits Social Engineering to Harvest Enterprise Credentials","The ACR Stealer campaign highlights how sophisticated social engineering (ClickFix lures) can bypass technical controls by manipulating users into executing malicious payloads themselves, rendering many perimeter defenses ineffective. Once deployed, the malware leverages living-off-the-land tools like MSHTA and obfuscated PowerShell to evade detection, while blockchain-based command-and-control resolvers make infrastructure takedowns extremely difficult. The theft of browser passwords and authentication tokens creates cascading risks including account takeover, lateral movement, and data exfiltration across the enterprise. This attack pattern underscores that untrained users remain the most exploitable vulnerability in any security architecture.",[153,154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-53 IA-5 (Authenticator Management)","MITRE ATT&CK T1059.001 (PowerShell)","MITRE ATT&CK T1566 (Phishing \u002F Social Engineering)","MITRE ATT&CK T1555.003 (Credentials from Web Browsers)","GDPR Article 32 – Security of Processing",{}]