ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an infostealer active since 2024, is targeting enterprise networks by stealing saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from OneDrive and SharePoint. The infection begins when a user pastes a command into the Windows Run dialog and presses Enter, often after being lured via malvertising or SEO-manipulated search results.

Microsoft’s Defender Experts team documented two primary delivery chains. The fileless chain uses mshta.exe to fetch remote HTA content, which executes a VBScript loader that decodes and runs PowerShell in memory. The payload is hidden within a JPEG image hosted on services like ImgBB, extracted, decrypted, and executed reflectively. This chain targets Chrome and Edge databases to steal credentials, cookies, and tokens, and also exfiltrates PDFs from Desktop and Downloads folders.

The second chain writes to disk by pulling a DLL from a WebDAV share over HTTPS. It uses obfuscated PowerShell to drop a ZIP file containing pythonw.exe and a Python script, which runs silently. Persistence is achieved via a hidden scheduled task masquerading as a software update, with timestomping and PowerShell history clearing to evade detection. In some cases, a second Python loader uses blockchain RPC endpoints to retrieve payloads or C2 addresses via smart contracts, a technique called EtherHiding.

No vulnerabilities are exploited; the attack relies entirely on user action. Microsoft recommends revoking tokens rather than just rotating passwords. Mitigations include removing the Run prompt via GPO, blocking mshta.exe with AppLocker or WDAC, and using attack surface reduction rules. Red Canary and SANS have observed similar campaigns using fake Claude AI pages as lures. ACR Stealer has been rebranded as Amatera Stealer, and the codebase may have changed owners.