Microsoft's security teams have detected a notable uptick in campaigns deploying **ACR Stealer**, an info-stealing malware-as-a-service (MaaS) believed to be a rebrand of **Amatera Stealer**. These attacks primarily target browser-stored credentials, session data, and critical documents. ### Evolving Attack Chains Between late April and mid-June, threat actors utilized the **ClickFix** social engineering method, **WebDAV** servers, and the **MSHTA** (Microsoft HTML Application Host) utility to deliver the malicious payloads. **Microsoft** has identified two primary intrusion chains as the most prevalent for **ACR Stealer**: #### Campaign 1: WebDAV-Based ClickFix This method initiates with a **ClickFix** lure that executes a command, running a malicious DLL from a remote **WebDAV** share via `rundll32.exe`. The abuse of **WebDAV** is a familiar tactic, previously seen in attacks delivering **Bumblebee** and **Voldemort** malware. Threat actors often obscure their activity by using GUID-based directory structures and filenames (e.g., `google.ct`) in the **WebDAV** path, mimicking legitimate resources to blend with expected network traffic. Upon establishing communication with the command-and-control (C2) infrastructure, a heavily obfuscated PowerShell script is executed. This script launches a malware installer, establishes persistence by creating a scheduled task disguised as a software update, manipulates timestamps, clears PowerShell history, and injects the final payload into a system process for in-memory execution. Some variants of this campaign also employ public blockchain services as dead-drop resolvers to retrieve updated payload locations or C2 addresses. This technique, also known as “**EtherHiding**,” has been observed in other sophisticated attacks. #### Campaign 2: MSHTA and Steganography In the second prominent delivery chain, the threat actor uses **ClickFix** to launch **MSHTA**, which then retrieves malicious content from the attacker's server. This triggers an obfuscated PowerShell downloader. The malware subsequently extracts an encrypted payload, cunningly concealed within a publicly hosted steganographic JPEG image, and executes it directly in memory. ### Data Exfiltration Objectives Despite their differences in delivery, both campaigns share the same objective: the comprehensive exfiltration of sensitive data. This includes: * Stealing passwords, cookies, session data, and authentication tokens from web browsers. * Decrypting browser data using the Windows Data Protection API (**DPAPI**). * Accessing **Chromium** browser databases on **Chrome** and **Edge**. * Searching for PDFs and **Microsoft 365** documents. * Collecting files from Desktop and Downloads folders. * Targeting enterprise-synchronized **OneDrive** and **SharePoint** directories. All harvested data is archived and prepared for exfiltration to the attacker's infrastructure.  **Microsoft** emphasizes that these two campaigns represent only a fraction of the observed **ACR Stealer** delivery methods, suggesting that additional execution chains are likely in use. ### Mitigating the Threat To defend against **ClickFix** attacks, users should exercise extreme caution and avoid copying and executing instructions from untrusted sources, particularly those claiming to fix errors or verify humanity. Organizations are strongly advised to: * Reduce exposure to web-based delivery chains by enforcing strict content filters, blocking low-reputation or new domains, and restricting access to online resources not essential for business operations. * Implement application control rules to restrict the launching of content from remote resources using tools like PowerShell, Python, `mshta.exe`, or `rundll32.exe`, especially from user-writeable paths. **Microsoft**'s comprehensive report provides a detailed list of recommended mitigations and specific indicators of compromise (IoCs) related to the observed **ACR Stealer** activity.