Back Blogs.Microsoft

ACR Stealer: Two observed intrusion chains amid increased threat activity

Blogs.Microsoft •Microsoft Security Research and Balaji Venkatesh S • July 16, 2026

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ACR Stealer Campaigns Exploit ClickFix and Steganography to Target Enterprises From late April to mid-June 2026, ACR Stealer, a malware-as-a-service operation, has ramped up its activity targeting enterprise users by stealing browser credentials, session tokens, and sensitive documents. The attack leverages ClickFix social engineering techniques to deceive victims into executing malicious commands via the Windows Run dialog or command prompt. The malware exploits vulnerabilities in Chromium-based browsers, using the Windows Data Protection API (DPAPI) to decrypt stored passwords and cookies. Two primary intrusion chains have been identified, employing WebDAV-hosted payloads and obfuscated PowerShell scripts to evade detection. The malware establishes persistence through scheduled tasks disguised as software updates and employs techniques like EtherHiding for command-and-control resolution. Microsoft has confirmed the ongoing threat and the sophistication of the ACR Stealer campaigns, urging enterprises to bolster their defenses against these attacks. 10 sources 70

Extracted Entities

ACR Stealer: Two observed intrusion chains amid increased threat activity

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)