Microsoft Warns of Surge in ACR Stealer Attacks

Microsoft has warned of a significant rise in cyberattacks leveraging the ACR Stealer malware, targeting enterprise clients. Between April and June, threat actors actively used social engineering tactics such as ClickFix, along with WebDAV and MSHTA tools to deliver malicious payloads to victim devices.

ACR Stealer operates under a Malware-as-a-Service (MaaS) model and, according to Microsoft, may be a rebrand of the known Amatera Stealer. The primary objective of these attacks is to steal passwords, cookies, authentication tokens, and other sensitive data stored in Chrome and Edge browsers, as well as corporate cloud storage platforms like OneDrive and SharePoint*.

Attackers employ multiple methods to deliver the malware. In one scenario, the attack begins with a phishing email prompting the victim to execute a command to 'fix an error.' This command launches a DLL file from a remote WebDAV server via rundll32.exe. In another approach, the MSHTA utility is used to download and execute an obfuscated PowerShell script that extracts an encrypted payload from a publicly available JPEG image.

To evade detection, threat actors use GUID structures in WebDAV paths, manipulate file timestamps, and leverage public blockchain services to update command-and-control server addresses. Microsoft advises organizations to tighten network traffic monitoring, block access to suspicious domains, and restrict script execution from untrusted sources.

Experts also recommend enforcing application control policies to limit the execution of tools like PowerShell, Python, mshta.exe, and rundll32.exe, particularly from user directories. A detailed list of indicators of compromise and mitigation recommendations is available in Microsoft’s report.