ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

## Executive summary Microsoft Defender Experts observed a rise in ACR Stealer activity from late April to mid‑June 2026: attackers lure victims with ClickFix malvertising or poisoned search results that prompt users to paste commands, then deploy one of two chains (a disk‑based WebDAV/Python/PowerShell chain or a fileless MSHTA/HTA+VBScript chain that extracts a payload from a JPEG) to steal browser credentials, authentication tokens, and sensitive documents for exfiltration; operators use techniques like DPAPI harvesting and EtherHiding for C2 resilience. Recommended defenses include blocking malicious run‑box commands, monitoring rundll32/MSHTA/WebDAV activity, revoking tokens, enabling cloud‑delivered protection, and training users not to paste commands from web prompts.