- Activity Window: Microsoft observed increased ACR Stealer activity across customer environments from April through June 2026.
- ClickFix Entry: Both prevalent routes use fake ClickFix prompts to trick users into running attacker-provided Windows commands.
- Execution Routes: One route uses a remote WebDAV file share; the other uses Microsoft HTML Application Host and a JPEG-concealed payload.
- Defender Response: Microsoft says the examples are not exhaustive; defenders should restrict risky execution and revoke tokens after suspected compromise.
Microsoft has published a warning enterprise customers after its Defender Experts observed increased ACR Stealer activity across customer environments from April through June 2026. ACR Stealer information-stealing malware puts browser credentials, live authentication tokens, and business documents at risk.
Both prevalent campaigns begin with ClickFix prompts that trick users into running attacker-provided commands. Their routes then diverge before converging on passwords, cookies, Microsoft 365 documents, and files in OneDrive and SharePoint. Microsoft disclosed no victim count, percentage increase, or other numerical measure of the rise.
Microsoft describes the two campaigns as prevalent examples, not a complete map of ACR Stealer delivery. Its scope caveat warns defenders that blocking only the documented execution paths could miss other routes into enterprise systems.
How the Two ClickFix Chains Work
Users who follow a ClickFix lure paste a command into a Run box and press Enter. Following the instruction turns a fake error or verification prompt into Windows command execution with the signed-in account’s access; neither route requires a software exploit. In 2025, fake update prompts used ClickFix to induce the same user-run mechanism, although that campaign is not evidence of the current ACR Stealer activity.
One route loads a malicious dynamic-link library (DLL) from a remote WebDAV file share through rundll32.exe. Obfuscated PowerShell and a bundled Python loader establish execution and persistence, including a scheduled task disguised as a software update. Its loader clears PowerShell history and injects the payload into a system process, leaving disk and persistence traces defenders can hunt.
Some variants also use EtherHiding, which relies on public blockchain services to point to changing payload locations or command-and-control addresses. Attackers can update those destinations without placing one fixed address throughout the chain, frustrating blocks based only on known infrastructure.
Unlike the first route, Microsoft HTML Application Host (MSHTA) retrieves remote HTML application content before an obfuscated PowerShell downloader runs. It executes an encrypted payload concealed in a JPEG largely in memory. Running mainly in memory reduces conventional disk artifacts, so detection must cover remote content and in-memory behavior as well as files written to disk.
Security analyst Brad Duncan, a SANS Internet Storm Center handler, described examining a 628 KB JPEG associated with the chain and finding no extractable content. Duncan’s observation does not establish that the image contained no concealed payload; it records only what he could identify in that examination.
Despite their different execution traces, both routes lead to the same theft operation. ACR Stealer accesses Chromium credential stores and Windows Data Protection API (DPAPI) routines to recover passwords, cookies, session data, and authentication tokens.
ACR Stealer also enumerates PDFs, Microsoft 365 documents, Desktop and Downloads files, and OneDrive and SharePoint directories before archiving material for exfiltration. Stolen session tokens can preserve account access after the malicious process is removed, while cloud-synchronized files widen the potential loss beyond one workstation.
What Defenders Can Block and Revoke
While an earlier Amatera credential-theft campaign also targeted browser and session data now sought by the documented ACR Stealer chains, it does not prove the current activity. WebDAV and MSHTA define the two prevalent execution routes, while Microsoft Defender Experts, the company’s incident-response and security team, warn that the malware uses a wider delivery range:
“These two campaigns represent some of the most prevalent ACR Stealer delivery campaigns observed by Defender Experts; however, they do not represent the full range of delivery methods used by this malware family.”
Microsoft Defender Experts (via Microsoft Security Blog)
Microsoft’s analysis recommends web filtering and execution controls for PowerShell, Python, MSHTA, and rundll32 to reduce exposure to the documented routes. For enterprise customers exposed through either route, revoking authentication tokens cuts off session access that malware removal can leave active.
