ACR Stealer: Two observed intrusion chains amid increased threat activity

Source: Microsoft Security Blog

Author: Microsoft Security Research and Balaji Venkatesh S

URL: https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/

ONE SENTENCE SUMMARY:

Microsoft observed two prevalent ClickFix-driven ACR Stealer campaigns using WebDAV/Python or MSHTA/PowerShell steganography to steal credentials and data.

MAIN POINTS:

1. Defender Experts saw elevated ACR Stealer activity from late April through mid-June 2026.
2. ClickFix social engineering prompts victims to execute attacker-provided commands from web lures.
3. Campaign 1 loads a remote DLL via HTTPS WebDAV using rundll32.exe.
4. Pushd maps WebDAV shares to local drives, reducing user visibility and scrutiny.
5. Obfuscated PowerShell deploys ZIP payloads, pythonw.exe loaders, and scheduled-task persistence.
6. Python loader uses multilayer string/API obfuscation to reconstruct payload only at runtime.
7. Final stage performs in-memory shellcode execution using VirtualAlloc and Fiber APIs.
8. Malware steals browser passwords, cookies, and tokens via DPAPI and targets enterprise documents.
9. Some variants resolve C2 through blockchain dead-drop techniques (EtherHiding) and Web3 endpoints.
10. Campaign 2 uses mshta.exe, VBScript COM decoding, steganographic JPEG payloads, and reflective loading.

TAKEAWAYS:

1. Prioritize detection of ClickFix behaviors and paste-and-run instructions invoking LOLBins.
2. Hunt for suspicious WebDAV usage, rundll32 remote DLL loads, and pushd drive mapping patterns.
3. Monitor obfuscated PowerShell, mshta-driven chains, and in-memory execution indicators.
4. Alert on scheduled tasks masquerading as updates, timestomping, and PowerShell history clearing.
5. Reduce impact by hardening credential storage, enforcing MFA, and enabling Defender XDR protections.