Back Feeds.4Sysops

ACR Stealer uses ClickFix lures and steganography to bypass browser security

Feeds.4Sysops •IT News • July 17, 2026

ACR Stealer is a malware-as-a-service threat that targets enterprise environments by stealing browser credentials, session tokens, and sensitive documents. The infection begins with a social engineering technique called ClickFix, which tricks users into pasting malicious commands into the Windows Run dialog or a terminal. Once executed, the malware targets Chromium-based browsers like Chrome and Edge to decrypt passwords and cookies using the Windows Data Protection API (DPAPI). Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ACR Stealer Campaigns Exploit ClickFix and Steganography to Target Enterprises From late April to mid-June 2026, ACR Stealer, a malware-as-a-service operation, has ramped up its activity targeting enterprise users by stealing browser credentials, session tokens, and sensitive documents. The attack leverages ClickFix social engineering techniques to deceive victims into executing malicious commands via the Windows Run dialog or command prompt. The malware exploits vulnerabilities in Chromium-based browsers, using the Windows Data Protection API (DPAPI) to decrypt stored passwords and cookies. Two primary intrusion chains have been identified, employing WebDAV-hosted payloads and obfuscated PowerShell scripts to evade detection. The malware establishes persistence through scheduled tasks disguised as software updates and employs techniques like EtherHiding for command-and-control resolution. Microsoft has confirmed the ongoing threat and the sophistication of the ACR Stealer campaigns, urging enterprises to bolster their defenses against these attacks. 10 sources 70

Extracted Entities

ACR Stealer uses ClickFix lures and steganography to bypass browser security

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (2)