Microsoft Warns of Surge in ACR Stealer Attacks on Enterprise Customers

Microsoft warns of a notable surge in ACR Stealer campaigns targeting enterprises; the MaaS infostealer harvests browser-stored credentials, session tokens, cryptocurrency wallet data, and sensitive files via malvertising, phishing, and trojanized installers, then exfiltrates data to attacker-controlled C2/Telegram and self-deletes. The report highlights enterprise risk (M365/GitHub/cloud tokens enabling lateral movement), monetization on IAB markets or for ransomware follow-on, and recommends mitigations including Credential Guard, conditional access, Defender for Endpoint behavioral rules, enterprise password managers, token monitoring, and blocking known C2 infrastructure.