ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

Back Thehackernews

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

Thehackernews • July 17, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ACR Stealer Campaigns Exploit ClickFix and Steganography to Target Enterprises From late April to mid-June 2026, ACR Stealer, a malware-as-a-service operation, has ramped up its activity targeting enterprise users by stealing browser credentials, session tokens, and sensitive documents. The attack leverages ClickFix social engineering techniques to deceive victims into executing malicious commands via the Windows Run dialog or command prompt. The malware exploits vulnerabilities in Chromium-based browsers, using the Windows Data Protection API (DPAPI) to decrypt stored passwords and cookies. Two primary intrusion chains have been identified, employing WebDAV-hosted payloads and obfuscated PowerShell scripts to evade detection. The malware establishes persistence through scheduled tasks disguised as software updates and employs techniques like EtherHiding for command-and-control resolution. Microsoft has confirmed the ongoing threat and the sophistication of the ACR Stealer campaigns, urging enterprises to bolster their defenses against these attacks. 10 sources 70

Extracted Entities

Attack Types (2)

Data Breach Malware

Malware (1)

MITRE ATT&CK (1)

T1555.003 - Credentials From Web Browsers

Platforms (1)