ACR Stealer Uses ClickFix, WebDAV, and Steganography to Steal Browser Credentials and Tokens

A surge in ACR Stealer activity from late April through mid-June 2026, with operators combining ClickFix social engineering, WebDAV-hosted payloads, PowerShell obfuscation, and steganography to compromise enterprise users.

The malware operations rely on ClickFix social-engineering lures to trick victims into pasting attacker-supplied commands into Windows Run dialogs or command prompts, ultimately stealing browser credentials, session cookies, authentication tokens, and sensitive business documents.

Although the delivery mechanisms differ, both campaigns aim to bypass browser protections, abuse Windows-native utilities, decrypt data protected by DPAPI, and stage high-value information for exfiltration.

The first campaign begins with malvertising or SEO-poisoned results that display fake verification prompts. Victims are instructed to execute commands that launch cmd.exe and invoke rundll32.exe against a DLL hosted on a remote WebDAV over HTTPS.

Operators use GUID-like directories and benign-looking filenames such as google.ct to make the traffic appear less suspicious.

In several observed variants, the attackers use pushd to map the remote WebDAV location to a temporary local drive before executing the payload.

This allows remote content to appear as a local path. More evasive versions launch through conhost.exe --headless , suppress console windows, and use delayed environment-variable expansion to obscure strings including pushd , rundll32 , and the remote host.

After the WebDAV-hosted DLL runs, it launches heavily obfuscated PowerShell. The script uses randomized variables, arithmetic no-operations, dead loops, and fake control flow to frustrate analysis.

Microsoft said in a report shared with GBhackers , ACR Stealer, reportedly a malware-as-a-service operation linked to the rebranding of Amatera Stealer, is being delivered through at least two prominent intrusion chains.

It then downloads a ZIP archive into a deceptive %LocalAppData%\Temp directory, often masquerading as software such as Logi Options Plus.

The payload includes a bundled pythonw.exe runtime and an obfuscated Python loader. Besides acting like an updater by deleting prior installations, the malware establishes persistence through a hidden scheduled task disguised as a software update.

It also copies timestamps from notepad.exe and clears PowerShell history to reduce forensic evidence.

The Python stage reconstructs shellcode at runtime through layered encoding, Base64 decoding, string manipulation, and zlib decompression.

It allocates executable memory with VirtualAlloc and uses the Windows Fiber API to execute the payload inside memory, sharply limiting disk artifacts.

In some cases, secondary loaders query public blockchain RPC services and Web3 infrastructure for command-and-control resolution, a dead-drop technique known as EtherHiding.

The second ACR Stealer campaign follows a more fileless path. A ClickFix lure launches mshta.exe , which retrieves a malicious HTA file from attacker-controlled infrastructure.

Embedded VBScript then abuses COM objects to decode and execute a PowerShell payload.

Rather than downloading a conventional -stage script, the PowerShell code retrieves a JPEG hosted on an image service.

Custom routines extract hidden content from image pixels, decrypt and decompress it, and execute the result directly in memory.

The payload dynamically resolves APIs including LoadLibrary , GetProcAddress , VirtualAlloc , and CreateThread , supporting reflective shellcode execution without a traditional executable file.

Both campaigns target Chromium browser databases, including Chrome and Edge Login Data and Web Data files, while invoking Windows DPAPI functions to recover protected passwords, cookies, and authentication artifacts.

They also Desktop, Downloads, OneDrive, and SharePoint-synchronized locations for PDFs and Microsoft 365 documents, then archive collected information ahead of exfiltration.

Microsoft recommends monitoring for ClickFix prompts, remote WebDAV access, mshta.exe activity, obfuscated PowerShell, unusual scheduled tasks, and browser-database access.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A newly disclosed Windows local privilege-escalation vulnerability, dubbed LegacyHive, could allow a standard user to…

Hackers leveraged a compromised Microsoft IIS server to gain initial access and deploy a previously…

Amazon Web Services (AWS) is currently investigating a significant billing issue affecting its Cost Explorer…

NadMesh is a new, industrial‑grade Go‑based botnet that weaponizes more than 20 RCE vectors to…

TP-Link has revealed several serious vulnerabilities affecting its Kasa EC70 and EC71 smart camera models,…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Fortinet…