ACR Stealer Uses Click Fix Lures to Steal Browser Tokens and Microsoft 365 Files
Summary: Microsoft's Defender Experts team tracked ACR Stealer activity rising across customer environments from late April to mid-June, with two ClickFix delivery chains that begin when a user pastes a command into the Run dialog. One chain pulls a DLL from a WebDAV share and writes to disk, while the other spawns mshta.exe, retrieves a JPEG from an image host, and executes a payload hidden in its pixels entirely in memory.
What you should know: Neither chain exploits a vulnerability, so patching removes nothing: every layer runs on the signed-in user's existing permissions, and Microsoft's remediation guidance is to revoke tokens rather than just rotate passwords because live session tokens are among what walks out.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026