Microsoft Warns of Surge

Overview

Microsoft has issued a warning about a surge in ACR Stealer malware attacks targeting enterprise customers. The malware, believed to be a rebranding of Amatera Stealer, is part of a Malware‑as‑a‑Service (MaaS) operation designed to steal browser‑stored passwords, authentication tokens, and sensitive documents.

Delivery Methods

Between late April and mid‑June, attackers used multiple intrusion chains, but Microsoft highlighted two as the most prevalent:

• ClickFix + WebDAV chain
  • Victims are tricked into executing a command that runs a malicious DLL from a remote WebDAV share using rundll32.exe.
  • Attackers disguise WebDAV paths with GUID‑based structures to mimic legitimate resources.
  • A heavily obfuscated PowerShell script launches the installer, establishes persistence, and injects the payload into memory.
  • Some variants use EtherHiding — leveraging blockchain services as dead‑drop resolvers for updated payloads.
• ClickFix + MSHTA chain
  • ClickFix launches mshta.exe, retrieving malicious content from attacker servers.
  • An obfuscated PowerShell downloader extracts an encrypted payload hidden inside a steganographic JPEG image.
  • The payload executes directly in memory, bypassing traditional detection.

Objectives of ACR Stealer

Regardless of delivery method, the malware’s goal is data theft:

• Steal browser passwords and cookies.
• Decrypt data via DPAPI.
• Access Chromium databases on Chrome and Edge.
• Search for PDFs and Microsoft 365 documents.
• Collect files from Desktop and Downloads folders.
• Target OneDrive and SharePoint directories synchronized with enterprise accounts.

All stolen data is archived and prepared for exfiltration to attacker infrastructure.

Microsoft’s Guidance

Microsoft Defender Experts warn that these campaigns represent only part of the ACR Stealer family’s delivery methods. To mitigate risks, organizations should:

• Avoid executing ClickFix commands — especially those claiming to fix errors or verify human identity.
• Enforce web filters to block low‑reputation or newly registered domains.
• Restrict access to unnecessary online resources.
• Apply application control rules to block execution of PowerShell, Python, mshta.exe, or rundll32.exe from user‑writeable paths.
• Monitor indicators of compromise provided in Microsoft’s report.

Expert in the Cloud Insight

ACR Stealer demonstrates how social engineering (ClickFix) combined with living‑off‑the‑land binaries (LOLBins) like PowerShell and MSHTA can bypass defenses and deliver stealthy payloads. For enterprises, the lesson is clear: harden against command‑line abuse, monitor for obfuscated scripts, and treat every “fix” command as suspect until verified.