Microsoft Sounds Alarm on Rising ACR Stealer Malware Campaigns
Microsoft reports a significant increase in attacks leveraging ACR Stealer, a malware-as-a-service operation that targets enterprise customers to harvest browser-stored passwords, authentication tokens, and sensitive documents. Between late April and mid-June, threat actors deploy the info-stealing payload using the ClickFix social-engineering technique, WebDAV servers, and the Microsoft HTML Application Host utility. Security researchers believe ACR Stealer is a rebranding of the previously known Amatera Stealer malware.
The attackers rely on two primary intrusion chains to deliver the malware. In the first method, a ClickFix lure tricks users into executing a command that loads a malicious DLL from a remote WebDAV share, using disguised filenames to blend with normal network traffic. A second chain uses MSHTA to retrieve malicious content and extract an encrypted payload hidden within a steganographic JPEG image. Both approaches launch heavily obfuscated PowerShell scripts that install a Python loader, create persistence through scheduled tasks, and execute the final payload directly in memory.
Once installed, ACR Stealer focuses on extracting valuable data from compromised systems. The malware steals passwords, cookies, and session data from web browsers, decrypting the information through the Windows Data Protection API. It also accesses Chromium-based browser databases on Chrome and Edge and searches for sensitive PDFs and Microsoft documents. Some variants even use public blockchain services as dead-drop resolvers to locate updated command-and-control addresses, making the malicious infrastructure harder to track and disrupt.