[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcVbUaUK6nwvWaAY6lG_uomIWhIMtG2BPG2X6crRJpH4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":60},"f56d2269-3226-4adf-98b7-03e217628e55","acr-stealer-surge-exploits-social-engineering-to-harvest-enterprise-credentials","abdf45e7-003b-4b4d-bc72-e7c30a60d60a","ACR Stealer Surge Exploits Social Engineering to Harvest Enterprise Credentials","The ACR Stealer campaign highlights how sophisticated social engineering (ClickFix lures) can bypass technical controls by manipulating users into executing malicious payloads themselves, rendering many perimeter defenses ineffective. Once deployed, the malware leverages living-off-the-land tools like MSHTA and obfuscated PowerShell to evade detection, while blockchain-based command-and-control resolvers make infrastructure takedowns extremely difficult. The theft of browser passwords and authentication tokens creates cascading risks including account takeover, lateral movement, and data exfiltration across the enterprise. This attack pattern underscores that untrained users remain the most exploitable vulnerability in any security architecture.","**Immediate actions:**\n- Block or restrict execution of MSHTA, PowerShell with obfuscated scripts, and WebDAV-based file access via application control policies.\n- Force re-authentication and revoke all active browser-stored tokens and sessions for potentially exposed users.\n- Deploy or update endpoint detection rules to flag ClickFix-style clipboard injection prompts and steganographic payload delivery.\n\n**Long-term improvements:**\n- Implement phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) across all enterprise accounts to reduce the value of stolen credentials.\n- Conduct targeted security awareness training focused on ClickFix and social engineering lures that instruct users to run commands manually.\n- Enforce a least-privilege browser credential policy by prohibiting browser-based password storage in favor of centrally managed password managers.\n\n**Detection measures:**\n- Enable advanced logging of PowerShell script block execution and MSHTA invocations and forward alerts to your SIEM in real time.\n- Monitor outbound DNS and network traffic for connections to blockchain-based or non-standard C2 resolution mechanisms.\n- Establish behavioral baselines for enterprise endpoints to detect anomalous credential access patterns indicative of info-stealer activity.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-53 IA-5 (Authenticator Management)","MITRE ATT&CK T1059.001 (PowerShell)","MITRE ATT&CK T1566 (Phishing \u002F Social Engineering)","MITRE ATT&CK T1555.003 (Credentials from Web Browsers)","GDPR Article 32 – Security of Processing",{},"published","2026-07-18T16:20:22.272591+00:00","2026-07-18T16:20:22.167+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-warns-of-surge-in-acr-stealer-attacks-on-customers\u002F","microsoft-warns-of-surge-in-acr-stealer-attacks-on-customers-3198a5","Microsoft warns of surge in ACR Stealer attacks on customers",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[54],{"id":55,"date":56,"edition":57,"title":58,"audio_url":59},"5237c9b6-0be7-4cd7-a7a3-a6f71d11fdaf","2026-07-19","morning","ThreatNoir Weekend Brief — July 19","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-19\u002Fthreatnoir-morning-brief-2026-07-19.mp3",[61,65,69],{"slug":62,"name":63,"problem":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":66,"name":67,"problem":68},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":70,"name":71,"problem":72},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]