ACR Stealer Campaigns Exploit ClickFix Lures to Target Enterprises

From late April to mid-June 2026, Microsoft Defender Experts detected a surge in ACR Stealer activity targeting enterprise environments. The attackers employed ClickFix lures to successfully steal browser credentials, authentication tokens, and sensitive documents. This campaign has raised significant concerns due to its effectiveness in compromising Microsoft 365 files and other sensitive data. Organizations across various sectors are affected, with the potential for widespread data breaches. Current mitigation strategies and security measures are being emphasized to counteract these threats. The situation remains active as defenders work to identify and neutralize these intrusion chains.

Key Points: • ACR Stealer campaigns have surged, utilizing ClickFix lures to steal sensitive data. • Targeted assets include browser credentials and Microsoft 365 files across enterprise environments. • Microsoft Defender Experts have observed this increased activity from late April to mid-June 2026.