Microsoft: ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer Campaigns Exfiltrate Enterprise Data via ClickFix Lures

Since early 2024, ACR Stealer a sophisticated infostealer has been targeting enterprise networks to harvest saved browser credentials, live session tokens, PDFs, and files from synced Microsoft 365, OneDrive, and SharePoint folders. Microsoft’s Defender Experts observed a surge in activity between late April and mid-June 2025, attributing successful infections to ClickFix lures that trick users into executing malicious commands.

Delivery Chains: Two Paths to Compromise

Microsoft documented two primary attack vectors, both initiated by a user pasting a command into the Windows Run dialog:

1. Fileless Execution (In-Memory)

   • Begins with mshta.exe fetching remote HTA content via malvertising or SEO-poisoned search results.
   • Uses VBScript and PowerShell to decode and execute a payload hidden in a JPEG’s pixel data (steganography).
   • Extracts and decrypts Chrome/Edge passwords, cookies, and tokens using DPAPI, then exfiltrates PDFs from Desktop/Downloads.
   • SANS Internet Storm Center linked this chain to fake Claude AI assistant pages served via malicious Google ads (e.g., sites.google.com URLs).

2. Disk-Based Execution (Leaves Traces)

   • Pulls a DLL from a WebDAV share over HTTPS, often disguised with benign filenames (e.g., google.ct).
   • Uses rundll32.exe or pushd to mount remote shares as temporary drives, evading detection.
   • Drops an obfuscated Python script in %LocalAppData%\Temp, persisting via a hidden scheduled task and timestomping (copying timestamps from notepad.exe).
   • Some variants employ EtherHiding, fetching payloads or C2 addresses from blockchain RPC endpoints to avoid traditional takedowns.

Infrastructure & Attribution

• Payload Hosts/C2 Domains: creativecommunityinfo[.]art, enhanceblabber[.]cc (linked to earlier campaigns by Brad Duncan).
• Fake Claude Lures: Also observed on GitLab (e.g., claude-desktop[.]gitlab[.]io).
• No Exploits, No CVEs: Both chains rely on user execution no vulnerabilities are exploited.
• Threat Actor Unclear: Microsoft avoids attribution, but ACR Stealer (aka AcridRain) was previously sold by SheldIO on Russian forums before a July 2024 shutdown. Some reports suggest a rebrand to Amatera Stealer, while others link it to GrMsk Stealer.

Detection & Mitigation

• Primary Vector: Blocking the Run dialog or restricting mshta.exe via GPO/AppLocker/WDAC can disrupt initial access.
• Behavioral Indicators:
  • rundll32.exe making network connections with no command-line parameters.
  • Scheduled tasks masquerading as software updates.
  • Timestomping and PowerShell history clearing.
• Post-Compromise Actions: Revoke tokens (not just passwords), isolate hosts, and monitor outbound connections to remote shares/image hosts.

Microsoft released Defender XDR hunting queries and 16 campaign domains, though the report notes these are representative, not exhaustive. The lures including fake CAPTCHAs and AI assistant pages continue to evolve, with ClearFake (a web-inject cluster) ranking as the top threat in Red Canary’s April 2025 telemetry.

Source: https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html

Microsoft Threat Intelligence cybersecurity rating report: https://www.rankiteo.com/company/microsoft-threat-intelligence

"id": "MIC1784291489",
"linkid": "microsoft-threat-intelligence",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'type': 'Enterprise'}],
 'attack_vector': ['Malvertising',
                   'SEO-poisoned search results',
                   'Fake Claude AI assistant pages',
                   'Malicious Google ads'],
 'data_breach': {'data_exfiltration': True,
                 'file_types_exposed': ['PDFs'],
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Browser credentials',
                                              'Live session tokens',
                                              'PDFs',
                                              'Files from Microsoft 365, '
                                              'OneDrive, and SharePoint']},
 'date_detected': '2024-01-01',
 'date_publicly_disclosed': '2025-06-15',
 'description': 'Since early 2024, ACR Stealer, a sophisticated infostealer, '
                'has been targeting enterprise networks to harvest saved '
                'browser credentials, live session tokens, PDFs, and files '
                'from synced Microsoft 365, OneDrive, and SharePoint folders. '
                'Microsoft’s Defender Experts observed a surge in activity '
                'between late April and mid-June 2025, attributing successful '
                'infections to ClickFix lures that trick users into executing '
                'malicious commands.',
 'impact': {'data_compromised': ['Browser credentials',
                                 'Live session tokens',
                                 'PDFs',
                                 'Files from Microsoft 365, OneDrive, and '
                                 'SharePoint'],
            'identity_theft_risk': 'High',
            'operational_impact': 'Data exfiltration, potential unauthorized '
                                  'access to enterprise systems',
            'systems_affected': ['Enterprise networks', 'Windows systems']},
 'initial_access_broker': {'entry_point': 'User execution via Windows Run '
                                          'dialog',
                           'high_value_targets': ['Microsoft 365',
                                                  'OneDrive',
                                                  'SharePoint']},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'User execution is a critical attack vector; blocking or '
                    'restricting tools like mshta.exe and the Run dialog can '
                    'disrupt initial access. Behavioral indicators such as '
                    'rundll32.exe making network connections with no '
                    'command-line parameters and scheduled tasks masquerading '
                    'as updates are key detection points.',
 'motivation': 'Data exfiltration for financial gain',
 'post_incident_analysis': {'corrective_actions': ['Implement '
                                                   'GPO/AppLocker/WDAC '
                                                   'restrictions',
                                                   'Enhance monitoring for '
                                                   'behavioral indicators'],
                            'root_causes': ['User execution of malicious '
                                            'commands',
                                            'Lack of restrictions on mshta.exe '
                                            'and Run dialog']},
 'ransomware': {'data_exfiltration': True},
 'recommendations': ['Block or restrict the Run dialog and mshta.exe via '
                     'GPO/AppLocker/WDAC.',
                     'Monitor for behavioral indicators like rundll32.exe '
                     'network connections without parameters.',
                     'Revoke tokens post-compromise, not just passwords.',
                     'Isolate hosts and monitor outbound connections to remote '
                     'shares/image hosts.',
                     'Use Defender XDR hunting queries for detection.'],
 'references': [{'date_accessed': '2025-06-15',
                 'source': 'Microsoft Defender Experts'},
                {'date_accessed': '2025-06-15',
                 'source': 'SANS Internet Storm Center'},
                {'date_accessed': '2025-06-15', 'source': 'Brad Duncan'},
                {'date_accessed': '2025-06-15', 'source': 'Red Canary'}],
 'response': {'containment_measures': ['Blocking the Run dialog',
                                       'Restricting mshta.exe via '
                                       'GPO/AppLocker/WDAC'],
              'enhanced_monitoring': 'Defender XDR hunting queries',
              'remediation_measures': ['Revoke tokens',
                                       'Isolate hosts',
                                       'Monitor outbound connections'],
              'third_party_assistance': 'Microsoft Defender Experts'},
 'threat_actor': ['SheldIO', 'GrMsk Stealer', 'Amatera Stealer'],
 'title': 'ACR Stealer Campaigns Exfiltrate Enterprise Data via ClickFix Lures',
 'type': 'Infostealer Campaign'}