Microsoft warns of surge in ACR Stealer attacks on customers

Microsoft observed a surge in ACR Stealer (an Amatera Stealer rebrand) attacks against enterprise customers between late April and mid‑June, delivered primarily via ClickFix social engineering using WebDAV-hosted DLLs with rundll32.exe and MSHTA-based PowerShell downloaders that extract steganographic payloads; the malware steals browser credentials, tokens, documents (including OneDrive/SharePoint synchronized files), and exfiltrates collected data, while using obfuscation, scheduled tasks, in-memory execution, and blockchain-based dead-drop resolvers for C2.