Microsoft has detected a sharp increase in ACR Stealer attacks targeting enterprise customers.
The malware steals passwords, authentication tokens, browser sessions, and sensitive documents. Attackers distribute it through fake verification prompts, remote WebDAV servers, and legitimate Windows utilities.
Researchers observed the latest activity between late April and mid-June. Although two delivery methods appeared most often, additional attack chains may also exist.
ACR Stealer Targets Sensitive Business Data
ACR Stealer operates as malware-as-a-service. This model allows cybercriminals to pay for access to the malware and use it in their own campaigns.
Researchers believe ACR Stealer is a rebranded version of Amatera Stealer. Its main purpose is to collect valuable information from infected Windows devices.
The malware targets passwords, cookies, session details, and authentication tokens stored in web browsers. In addition, it can decrypt protected browser data through the Windows Data Protection API.
Attackers focus particularly on Chromium-based browsers, including Google Chrome and Microsoft Edge.
However, browser information is not the only target. The malware also searches for PDF files and Microsoft 365 documents. Furthermore, it collects files from Desktop and Downloads folders.
Enterprise-synchronized OneDrive and SharePoint directories may also expose valuable corporate information.
ClickFix Lures Start the Infection
Many ACR Stealer attacks begin with the ClickFix social engineering technique.
A fraudulent website displays a fake error or verification message. It then instructs the victim to copy and execute a command to solve the supposed problem.
However, the command actually launches the malware infection process.
Because the victim performs the action manually, attackers can abuse trusted Windows tools. This approach may also help the activity appear legitimate to security systems.
Users should therefore avoid running commands provided by unfamiliar websites. This is especially important when a page claims that the action will fix an error or confirm that the visitor is human.
First Attack Chain Uses WebDAV Servers
In the first common infection chain, a ClickFix lure launches a malicious DLL from a remote WebDAV share. The attackers use the legitimate rundll32.exe Windows utility to execute the file.
The WebDAV paths use directory structures and filenames designed to resemble genuine online resources. As a result, the malicious traffic can blend in with normal network activity.
Once the system connects to the attackers’ command-and-control infrastructure, it runs a heavily disguised PowerShell script.
The script installs a bundled Python loader and creates a scheduled task. Attackers disguise this task as a normal software update to maintain access after the computer restarts.
The malware also changes file timestamps and deletes PowerShell history. These steps make the infection more difficult to investigate.
Finally, the loader injects ACR Stealer into a legitimate system process. The malware then runs directly in memory.
Blockchain Services Hide Updated Locations
Some versions of ACR Stealer use public blockchain services to locate new payloads or command-and-control servers.
This technique is sometimes called EtherHiding. Attackers store instructions or addresses through blockchain-based services instead of placing them directly inside the malware.
Therefore, they can update their infrastructure without changing the original malicious files. Blocking the operation can also become more difficult because defenders may hesitate to restrict legitimate blockchain services.
Second Chain Hides Malware Inside Images
The second major delivery method also begins with a ClickFix prompt.
However, this version uses the Microsoft HTML Application Host, known as MSHTA, to retrieve malicious content from an attacker-controlled server.
The attack then launches an obfuscated PowerShell downloader. Afterward, the malware extracts an encrypted payload hidden inside a publicly hosted JPEG image.
This technique is known as steganography. It allows attackers to conceal malicious data inside an ordinary-looking image.
The system decrypts the hidden payload and executes it directly in memory. Consequently, the malware may leave fewer obvious files on the device.
Stolen Information Prepared for Exfiltration
Despite their technical differences, both ACR Stealer attack chains have the same goal.
The malware searches the infected device for useful information and collects the results. It then places the stolen data into an archive before sending it to the attackers.
Stolen browser tokens and session cookies create a serious risk. Criminals may use them to enter corporate accounts without needing the victim’s password.
Meanwhile, synchronized cloud folders may contain contracts, financial information, internal reports, customer data, or other confidential documents.
Organizations Can Reduce the Risk
Companies can reduce exposure by blocking newly registered or low-reputation domains. They should also restrict access to online resources that employees do not require for their work.
In addition, application control rules can prevent trusted tools from launching remote content. Organizations should closely monitor PowerShell, Python, MSHTA, and rundll32.exe, especially when they run files from user-writable locations.
Security teams should also investigate unusual scheduled tasks, deleted command histories, suspicious WebDAV connections, and unexpected access to browser databases.
Most importantly, employees need to recognize ClickFix prompts. Legitimate websites should not ask visitors to copy commands into PowerShell, Command Prompt, or other system tools.
0 responses to “ACR Stealer Attacks Surge Against Enterprise Customers”