# Microsoft Warns of Surge in ACR Stealer Attacks: Info-Stealing Malware Targets Enterprise Credentials and Documents
## The Threat
Microsoft has issued a formal warning about a dramatic surge in ACR Stealer attacks targeting enterprise customers, with threat actors leveraging sophisticated social engineering and legitimate Windows utilities to steal browser-stored credentials, authentication tokens, and sensitive documents. Between late April and mid-June 2026, the malware-as-a-service operation—believed to be a rebranding of the older Amatera Stealer—demonstrated increasing prevalence across multiple organizational networks, prompting heightened scrutiny from Microsoft Defender Experts.
ACR Stealer operates as a comprehensive data exfiltration tool, focusing specifically on high-value targets within enterprise environments. The malware systematically extracts passwords, browser cookies, session data, and authentication tokens stored in Chrome, Edge, and other Chromium-based browsers. Beyond credential theft, ACR Stealer targets organizational crown jewels: Microsoft 365 documents, PDF files stored across Desktop and Downloads folders, and enterprise-synchronized OneDrive and SharePoint directories. The attackers decrypt protected browser data using the Windows Data Protection API (DPAPI), a legitimate system feature that becomes a liability when malware gains local execution.
What distinguishes ACR Stealer from commodity information stealers is the sophistication of its delivery mechanisms and persistence techniques. Threat actors have deployed two primary attack chains that Microsoft identifies as most prevalent, each combining social engineering with legitimate—but exploitable—Windows tools like MSHTA (Microsoft HTML Application Host) and rundll32.exe. The campaigns employ obfuscated PowerShell execution, WebDAV abuse, steganography, and even blockchain services to maintain operational security, demonstrating a maturity that suggests well-resourced adversaries behind the malware-as-a-service offering.
## Severity and Impact
| Attribute | Details |
|-----------|---------|
| Threat Category | Information Stealer / Credential Theft |
| Attack Vector | Social Engineering (ClickFix) + Remote Code Execution |
| Compromise Scope | Credential databases, authentication tokens, sensitive documents, organizational cloud storage |
| Attack Complexity | Medium (requires user interaction via ClickFix social engineering) |
| Authentication Required | No (post-compromise execution runs in user context) |
| Primary Impact | Confidentiality breach; post-compromise credential compromise enabling lateral movement |
| Affected Environment | Enterprise networks targeting mid-to-large organizations |
## Affected Products
Targeted Browsers & Applications:
Attack Delivery Vectors (Windows Utilities):
Operating System:
Note: ACR Stealer is not a vulnerability in specific products but rather a post-compromise attack requiring initial social engineering success. Organizations running any recent version of Windows with enterprise productivity applications are potentially at risk if users fall victim to ClickFix social engineering.
## Mitigations
Immediate Actions:
1. Disable ClickFix Susceptibility Through User Training: Establish a formal policy prohibiting users from copying and executing commands from unknown online sources, particularly those claiming to fix errors or verify human status. Security awareness training should emphasize that legitimate software will never require users to execute raw command-line instructions.
2. Implement Application Control Policies: Deploy Windows Defender Application Control or third-party application whitelisting to restrict execution of PowerShell, Python, mshta.exe, and rundll32.exe when launched from user-writeable paths or when attempting to fetch remote content. This blocks common ACR Stealer execution chains.
3. Enforce Web Filtering & Domain Reputation Controls: Block low-reputation domains, newly registered domains, and domains outside approved business categories. Implement DNS filtering to prevent users from accessing attacker-controlled infrastructure that hosts malicious payloads.
4. Restrict Remote Resource Execution: Disable or heavily restrict WebDAV access where not required for business operations. Implement network segmentation to limit lateral movement if WebDAV shares are compromised.
5. Monitor for Suspicious Process Behavior: Alert on rundll32.exe or MSHTA execution chains initiating WebDAV connections, PowerShell launching from unusual paths, and creation of scheduled tasks with deceptive names (e.g., "Windows Update").
6. Browser Isolation & Credential Isolation: Where feasible, implement browser isolation technologies for external web access and consider hardware-backed credential storage to limit DPAPI decryption attacks.
7. Audit OneDrive & SharePoint Access Logs: Review access patterns for unusual bulk file downloads or access from anomalous IP addresses, particularly from user accounts with directory synchronization enabled.
Detection & Response:
## References
---
## HackWire Analysis
The ACR Stealer surge reflects a troubling trend in the malware-as-a-service ecosystem: the democratization of sophisticated credential-stealing capabilities. What once required deep technical expertise now ships as a turnkey service, complete with multiple delivery chains, obfuscation layers, and evasion techniques. Microsoft's observation of sustained campaign activity across a two-month window isn't just a blip—it signals that ACR operators have moved beyond experimental phases into reliable revenue generation.
The strategic reliance on ClickFix as a primary delivery mechanism is particularly telling. This social engineering technique exploits a fundamental human vulnerability: the willingness to follow step-by-step instructions when faced with an apparent technical problem. Unlike malware that depends on unpatched vulnerabilities or advanced exploits, ClickFix works against any version of Windows running any security tools. It's not a technical problem; it's a trust problem. Threat actors are betting (correctly) that a percentage of users will execute commands if the framing is sufficiently convincing.
The second delivery chain—leveraging MSHTA to retrieve encrypted payloads hidden in steganographic JPEG images—demonstrates an arms race against detection systems. Traditional file-based malware scanning becomes ineffective when payloads are embedded in image files and decrypted at runtime. Combined with the use of blockchain services as dead-drop resolvers for C2 infrastructure, ACR operators have built a resilient delivery pipeline that degrades gracefully when individual infrastructure components are compromised.
What defenders should recognize is that ACR Stealer is optimized specifically for enterprise credential theft at scale. Bulk access to Microsoft 365 documents, OneDrive, and SharePoint creates opportunities for espionage, intellectual property theft, and downstream targeted attacks against supply chain partners. A single successful compromise can cascade into organizational compromise if those stolen credentials are used for lateral movement. This isn't just about stolen passwords—it's about attackers gaining persistent, legitimate-looking access to the most sensitive assets in modern enterprises.
Organizations should treat ClickFix awareness as a foundational security control, equivalent to MFA or endpoint detection. The attacks Microsoft observed required user interaction, but in large enterprises, statistical certainty means someone will click. The question is whether application control, network filtering, and behavioral monitoring will catch the attack before sensitive data is exfiltrated.
— HackWire Editorial
---
## Related Coverage