ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

Microsoft and other telemetry sources describe active ACR Stealer campaigns (also linked to Amatera/AcridRain variants) that use a paste-and-run Run dialog vector to deploy two main chains — a fileless mshta→PowerShell→JPEG-embedded payload path and a disk-writing WebDAV/rundll32 path — to harvest browser credentials, authentication tokens, PDFs, and synced cloud documents; defenders are advised to revoke tokens, apply application control, block mshta/rundll32 behaviors, hunt for suspicious rundll32 network activity and remove the Run prompt to cut the vector.