Microsoft Warns of a Surge in ACR Stealer Attacks on Enterprise Customers

Microsoft says it observed a surge in ACR Stealer attacks against its enterprise customers between late April and mid-June 2026, with a threat actor using the ClickFix social engineering trick to kick off two distinct delivery chains that end in stolen browser passwords, authentication tokens, and cloud-synced documents. Microsoft’s Defender Experts team published the underlying analysis on July 16, 2026, and BleepingComputer covered it two days later.

ACR Stealer is sold as malware-as-a-service, and its branding has shifted before. Proofpoint documented the same family being overhauled and rebranded as “Amatera Stealer” in June 2025, with what that research described as improved evasion and sophistication. Microsoft’s report ties this year’s campaigns back to that lineage, describing ACR Stealer as a MaaS offering “associated with the rebranding of Amatera Stealer.” BleepingComputer’s coverage puts it more directly, calling the malware “believed to be a rebranding of the Amatera Stealer malware.” Either way, this family’s name and code have kept shifting since researchers first started tracking it.

Two delivery chains, one ClickFix trick

Both intrusion chains Microsoft tracked start the same way: a ClickFix lure talks a user into copying and running a command, usually under the pretense of “verifying” they are human or fixing an error. What happens after that first click diverges.

In the first chain, the pasted command launches cmd.exe, which in turn runs rundll32.exe to load a malicious DLL hosted on a remote WebDAV share reached over HTTPS. Microsoft says the threat actor uses GUID-style folder and file names on that WebDAV path, mimicking legitimate resources such as google.ct, to blend the traffic in with expected network activity. Once that DLL runs, it launches a heavily obfuscated PowerShell script that installs a Python-based loader, creates a scheduled task disguised as a legitimate software update for persistence, copies file timestamps from a trusted Windows binary like notepad.exe onto its own files, clears PowerShell history, and injects the final stealer payload into a running process so it executes in memory rather than as a file on disk. Some variants of this chain skip a traditional command-and-control server altogether: they use public blockchain services as a dead drop to look up updated payload locations or C2 addresses, a technique known as EtherHiding.

The second chain is fileless from the start. It uses mshta.exe, the built-in Windows utility for running HTML Application files, to fetch a remote HTA file containing a VBScript loader. That loader decodes and runs an obfuscated PowerShell downloader, which retrieves what looks like an ordinary JPEG image from a public image-hosting service. The image is not ordinary: Microsoft says the payload is encrypted and hidden inside the picture’s pixel data, then extracted and executed directly in memory once the PowerShell script decodes it.

What the malware is after

Despite the different delivery methods, both chains chase the same targets. ACR Stealer decrypts browser-stored passwords, cookies, and session tokens protected by the Windows Data Protection API (DPAPI), reaching into Chromium-based browsers like Chrome and Edge. It also searches for PDFs and Microsoft 365 files on the Desktop and in the Downloads folder, and Microsoft specifically calls out enterprise-synchronized OneDrive and SharePoint directories as a target. Everything collected is archived locally before being exfiltrated to the attacker, handing them a route into whatever cloud accounts or internal systems those stolen credentials and tokens unlock.

Microsoft’s advice, and why ClickFix keeps working

Microsoft is explicit that these two chains are only the most prevalent patterns its Defender Experts team observed, not a complete list of how ACR Stealer gets delivered, so defenders should not treat blocking these specific indicators as a full fix. The company’s core recommendation is user education: train people to never copy and run commands from a webpage or pop-up, especially ones framed as fixing an error or proving they are not a bot, since that single click is what starts both chains. Beyond that, Microsoft recommends enforcing web filtering to block low-reputation or newly observed domains, using application control policies to restrict tools like powershell.exe, Python interpreters, mshta.exe, and rundll32.exe from launching content from remote or user-writable locations, and enabling cloud-delivered protection and behavior-based detection so in-memory payloads are more likely to get caught even when no malicious file ever touches disk.

ClickFix has become one of the most common ways attackers get an initial foothold precisely because it does not rely on a software vulnerability at all. It relies on a user trusting an instruction enough to paste it into their own Run dialog or terminal, which is why Microsoft keeps returning to the same first line of defense: teach people to recognize the lure before worrying about what comes after it.