ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

# ACR Stealer Returns With Stealthier ClickFix Campaigns, Bypassing Browser Security and Stealing M365 Files

Microsoft's Defender Experts have tracked a sustained surge in ACR Stealer activity targeting enterprise environments through deceptive ClickFix lures, revealing two sophisticated delivery chains that harvest browser credentials, authentication tokens, sensitive documents, and cloud-stored files. The infostealer, in circulation since 2024, has evolved into a multi-vector threat capable of running entirely in memory to evade detection—or leaving forensic artifacts when tactics shift. Security researchers warn that the campaigns are unusually successful, combining social engineering with pixel-level steganography and living-off-the-land techniques.

## The Threat

ACR Stealer is a credential-harvesting malware designed to extract and exfiltrate sensitive data from compromised Windows endpoints. Its primary targets are:

The malware's dual operational capability—fileless execution in memory or disk-based infection with obfuscated payloads—allows threat actors to choose between stealthiness and speed depending on target defenses. Microsoft's detection data shows the malware actively harvesting credentials through April and June 2026, with successful infections across customer environments suggesting widespread enterprise exposure.

## Background and Context

ACR Stealer emerged in 2024 as one of a growing class of infostealers targeting corporate networks, joining competitors like RedLine, Lumma, and Vidar in the ransomware supply chain. What distinguishes ACR's recent campaigns is the sophisticated social engineering wrapper: ClickFix lures.

ClickFix is a deceptive technique that uses fake browser notifications to trick users into copying and pasting malicious commands into Windows Run boxes (Win+R). The notification mimics legitimate system alerts ("Your browser is outdated," "Security certificate expired") and directs users to paste a provided command. Because the command originates from the user's own keyboard and clipboard—not a traditional executable download—many endpoint detection and response (EDR) systems fail to flag the execution as malicious.

In parallel discovery, Red Canary documented ACR Stealer activity in May 2026 targeting users with fake Claude Code (Anthropic's code editor) landing pages hosted on GitLab, such as claude-desktop.gitlab.io. A month earlier, SANS Internet Storm Center handler Brad Duncan logged infections traced to a multi-OS phishing page impersonating Claude, delivered through malicious Google ads and hidden behind sites.google.com obfuscation. The same domain indicators later appeared in Microsoft's reporting, suggesting coordinated infrastructure or copycat groups leveraging the same lures.

## Technical Details: Two Delivery Chains

Microsoft's Defender Experts identified two distinct attack chains, both initiated by a user pasting a command into the Windows Run dialog:

### Chain 1: Fileless (Memory-Only) Execution

This variant prioritizes stealth and leaves minimal forensic artifacts:

1. Initial command spawns mshta.exe to fetch remote HTML Application (HTA) content

2. Embedded VBScript leverages Component Object Model (COM) interfaces to decode and launch PowerShell

3. PowerShell stage:

- Generates a unique victim identifier

- Disables certificate validation to avoid TLS inspection

- Retrieves a JPEG image from an image-hosting service (observed: ImgBB)

4. Payload extraction: Custom routines carve the embedded malware from JPEG pixel data, decrypt it, decompress it, and execute it reflectively in memory

5. Credential harvesting: Invokes Windows Data Protection API (DPAPI) to decrypt passwords, cookies, and authentication tokens from Chrome and Edge browser databases

6. File collection: Exfiltrates PDFs and documents to attacker-controlled command-and-control (C2) infrastructure

Key stealth feature: The malware never touches disk for the final payload, making traditional file-based detection ineffective.

### Chain 2: Disk-Based Execution (Three Variants)

This approach is faster but more detectable:

1. Remote DLL retrieval: A pasted command invokes rundll32.exe to pull a malicious DLL from a WebDAV share over HTTPS, using a GUID directory to obfuscate the source

2. Drive mounting (variants A & B): Uses pushd to mount the remote WebDAV share as a temporary local drive, making the payload appear to load from a local path

3. Console hiding (variant C): Wraps execution in conhost.exe --headless to suppress visible windows and hides critical strings (pushd, rundll32, C2 domain) behind delayed environment-variable expansion

4. Obfuscated PowerShell: Drops a ZIP archive into a folder under %LocalAppData%\Temp with an innocuous name (e.g., "LogiOptionsPlus")

5. Python execution: Bundled pythonw.exe (Windows Python interpreter) launches an embedded Python script for stealth; Python execution is less commonly monitored than PowerShell

Key forensic indicator: Red Canary's April telemetry and Microsoft's June observations both document the same WebDAV domain pattern, suggesting shared infrastructure or phishing-kit reuse.

## How It Spreads: ClickFix, Malvertising, and AI Brand Exploitation

ACR Stealer's delivery relies on a combination of techniques:

| Delivery Vector | Mechanism | Observed Examples |

|---|---|---|

| Malvertising | Malicious Google Ads landing on attacker-controlled pages | Fake Claude/ChatGPT interfaces |

| SEO Poisoning | Search results manipulated to rank malicious pages high | Generic security warnings, outdated browser alerts |

| Fake AI Tools | Impersonation of popular platforms (Claude, ChatGPT) | claude-desktop.gitlab.io, sites.google.com subdomains |

| ClickFix Prompt | Fake system notification instructing copy-paste of command | "Update your browser," "Fix security certificate" |

The use of Claude and ChatGPT branding is particularly effective: users seeking legitimate AI tools are redirected to phishing pages offering fake offline versions or "premium features." The emotional hook—solving an urgent security or usability problem—bypasses rational skepticism.

## Implications for Organizations

ACR Stealer poses several critical risks:

Credential Compromise at Scale: Stolen browser tokens enable account takeover without password resets. Attackers can access email, cloud storage, and SaaS applications as legitimate users.

Lateral Movement: Exfiltrated Microsoft 365 credentials and documents often contain additional sensitive information—API keys, VPN configs, employee directories—that accelerate network compromise.

Ransomware Pipeline: Infostealers like ACR are frequently used by big-game hunting ransomware groups (Cl0p, LockBit, BlackCat) to survey network architecture before deploying encryption payloads.

Supply Chain Exposure: Compromised service accounts or developer credentials in stolen OneDrive/SharePoint folders can expose source code, build pipelines, and third-party integrations.

Dwell Time: The fileless variant's ability to run entirely in memory means infected endpoints may evade detection for weeks or months, maximizing data exfiltration window.

## Recommendations

Immediate Actions:

Longer-Term Defenses:

---

## HackWire Analysis

ACR Stealer's resurgence in mid-2026 reveals a critical blind spot in enterprise security: the user-initiated command. Traditional EDR solutions focus on detecting *suspicious process execution*, but when a user voluntarily pastes a command into Run, the signal is indistinguishable from legitimate administration. This is not a technical failure—it's a social engineering victory.

What's particularly striking is the brazenness of the ClickFix lure. In 2024, similar tactics were fringe. By 2026, they've become mainstream. Microsoft's observation of "successful campaigns" across customer environments isn't hyperbole—it reflects a tectonic shift in attacker behavior. Why invest in zero-days or supply-chain compromises when human credibility is the actual vulnerability?

The use of Claude and ChatGPT branding is no accident. These are aspirational brands with high trust; AI tool adoption is exploding in enterprises, and users are eager to install "offline versions" or "premium tools." The attacker isn't fighting Windows Defender—they're fighting user skepticism, and they're winning.

The fileless variant is equally instructive. By embedding payloads in JPEG pixels and executing entirely in memory, ACR bypasses disk-scanning EDR and forces detection to rely on behavioral signals (DPAPI calls, browser data access, suspicious network traffic). Organizations running only signature-based detection will miss this entirely. Memory-only malware is no longer a theoretical concern—it's operational reality.

Organizations should assume: *If your users can be tricked into pasting a command, your endpoint is compromised.* The path forward is threefold: (1) disable ClickFix vectors where possible, (2) implement token revocation procedures that don't rely on password rotation, and (3) monitor for the behavioral patterns ACR leaves—even in memory. — HackWire Editorial

---

## Related Coverage