Do Son 
At a glance
| Malware family | ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) |
| Threat actor | No named actor; sold via malware-as-a-service (MaaS) |
| Target / victims | Enterprise Windows environments; activity up from late April to mid-June 2026 |
| Delivery vector | ClickFix lures via malvertising and poisoned search results |
| Key capabilities | Browser credential and token theft; document collection; in-memory execution |
| Source | Microsoft Defender Experts |
TL;DR
Microsoft says ACR Stealer activity climbed across customer networks from late April 2026 to mid-June 2026. The attacks trick users with ClickFix prompts, then steal browser logins and files. Two delivery chains stand out, and both chase the same prize: credentials.
Delivery
The ClickFix trick
Both chains start with a ClickFix lure. Victims reach it through malvertising or poisoned search results. The page shows a fake fix and tells the user to paste a command. That command then kicks off the infection. Microsoft’s Defender Experts say the campaigns are “successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents.” So a single copy-paste hands the attacker a foothold. From there, the two chains split apart.
Two infection chains
Chain 1: WebDAV, Python, and blockchain
The first chain leaves marks on disk. The pasted command loads a DLL from a remote WebDAV share over HTTPS. Some variants mount that share as a fake local drive to look normal. Next, an obfuscated PowerShell script runs and installs the payload. It hides a Python loader inside a folder that mimics real software. Then it sets a scheduled task disguised as an update for persistence. In the stealthiest variant, the loader runs through a headless console and hides key command parts with environment-variable tricks. It even copies file timestamps from a trusted Windows binary and wipes PowerShell history to blur the trail. Notably, a few intrusions pull their C2 address from a public blockchain. Microsoft ties this to the EtherHiding technique. That trick lets operators swap infrastructure without changing the malware.
Chain 2: fileless with a hidden image
The second chain barely touches the disk. Here the command spawns MSHTA to fetch remote HTA content. A VBScript loader then decodes and runs PowerShell in memory. After that, the script downloads a JPEG from an image host. The image hides the real payload inside its pixels. The script extracts, decrypts, and runs that payload in memory. As a result, file-based scanners have little to catch.
C2 and data theft
Both chains chase the same goal. The malware unlocks stored browser secrets using Windows DPAPI. It grabs saved passwords, cookies, and session tokens from Chrome and Edge. It also hunts for PDFs and Microsoft 365 files across the system. Enterprise folders like OneDrive and SharePoint draw extra interest. The stealer then bundles this data for exfiltration. Stolen tokens matter most here. They can unlock cloud accounts even after a password change.
Who is behind ACR Stealer
No single group owns this activity. ACR Stealer is sold as a service, so many actors can rent it. Researchers also link it to a rebrand of the earlier Amatera Stealer. Microsoft bases its attribution on observed behavior and open-source intelligence, not a named crew. So treat the family label as behavioral, not a fixed actor. Red Canary flagged a matching pattern in May, from April data, ahead of Microsoft’s post.
How to defend against ACR Stealer
Start with the human layer. Warn staff never to paste commands from a web prompt. Microsoft’s guidance goes further on cleanup. Victims should revoke active tokens, not just reset passwords. That step cuts off stolen session access. On the endpoint, turn on cloud-delivered protection so new variants get blocked fast.
Detection tips
Watch for ClickFix-style Run-box commands. Flag rundll32 or MSHTA reaching out to remote shares or domains. Also monitor odd WebDAV connections and headless console use. Hunt for obfuscated PowerShell and history-clearing behavior. Finally, alert on any process that touches browser credential stores.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
