ACR Stealer Uses ClickFix, WebDAV, and Steganography to Steal Browser Credentials and Tokens

A surge in ACR Stealer activity from late April through mid-June 2026, with operators combining ClickFix social engineering, WebDAV-hosted payloads, PowerShell obfuscation, and steganography to compromise enterprise users.

The malware operations rely on ClickFix social-engineering lures to trick victims into pasting attacker-supplied commands into Windows Run dialogs or command prompts, ultimately stealing browser credentials, session cookies, authentication tokens, and sensitive business documents.

Although the delivery mechanisms differ, both campaigns aim to bypass browser protections, abuse Windows-native utilities, decrypt data protected by DPAPI, and stage high-value information for exfiltration.

The first campaign begins with malvertising or SEO-poisoned search results that display fake verification prompts. Victims are instructed to execute commands that launch cmd.exe and invoke rundll32.exe against a DLL hosted on a remote WebDAV share over HTTPS.

Operators use GUID-like directories and benign-looking filenames such as google.ct to make the traffic appear less suspicious.

In several observed variants, the attackers use pushd to map the remote WebDAV location to a temporary local drive before executing the payload.

This allows remote content to appear as a local path. More evasive versions launch through conhost.exe --headless, suppress console windows, and use delayed environment-variable expansion to obscure strings including pushd, rundll32, and the remote host.

After the WebDAV-hosted DLL runs, it launches heavily obfuscated PowerShell. The script uses randomized variables, arithmetic no-operations, dead loops, and fake control flow to frustrate analysis.

Microsoft said in a report shared with GBhackers, ACR Stealer, reportedly a malware-as-a-service operation linked to the rebranding of Amatera Stealer, is being delivered through at least two prominent intrusion chains.

It then downloads a ZIP archive into a deceptive %LocalAppData%\Temp directory, often masquerading as software such as Logi Options Plus.

ACR Stealer Uses ClickFix

The payload includes a bundled pythonw.exe runtime and an obfuscated Python loader. Besides acting like an updater by deleting prior installations, the malware establishes persistence through a hidden scheduled task disguised as a software update.

It also copies timestamps from notepad.exe and clears PowerShell history to reduce forensic evidence.

The Python stage reconstructs shellcode at runtime through layered encoding, Base64 decoding, string manipulation, and zlib decompression.

It allocates executable memory with VirtualAlloc and uses the Windows Fiber API to execute the payload inside memory, sharply limiting disk artifacts.

In some cases, secondary loaders query public blockchain RPC services and Web3 infrastructure for command-and-control resolution, a dead-drop technique known as EtherHiding.

The second ACR Stealer campaign follows a more fileless path. A ClickFix lure launches mshta.exe, which retrieves a malicious HTA file from attacker-controlled infrastructure.

Embedded VBScript then abuses COM objects to decode and execute a PowerShell payload.

Rather than downloading a conventional next-stage script, the PowerShell code retrieves a JPEG hosted on an image service.

Custom routines extract hidden content from image pixels, decrypt and decompress it, and execute the result directly in memory.

The payload dynamically resolves APIs including LoadLibrary, GetProcAddress, VirtualAlloc, and CreateThread, supporting reflective shellcode execution without a traditional executable file.

Both campaigns target Chromium browser databases, including Chrome and Edge Login Data and Web Data files, while invoking Windows DPAPI functions to recover protected passwords, cookies, and authentication artifacts.

They also search Desktop, Downloads, OneDrive, and SharePoint-synchronized locations for PDFs and Microsoft 365 documents, then archive collected information ahead of exfiltration.

Microsoft recommends monitoring for ClickFix prompts, remote WebDAV access, mshta.exe activity, obfuscated PowerShell, unusual scheduled tasks, and browser-database access.

Indicators of compromise (IOC)

Campaign 1
Indicator	Description
looksta[.]icu	C2 domain
contrite.quirksturdy[.]icu	C2 domain
ux.strainedeasily[.]icu	C2 domain
cpppemwjewjoiwejow[.]sale	C2 domain
breaksd.wifihot[.]icu	C2 domain
walter.filloco[.]icu	C2 domain
fast.raidher[.]icu	C2 domain
apigrokcloud[.]icu	C2 domain
Campaign 2
enhanceblabber[.]cc	C2 domain
deep-harborio[.]com	1st Stage payload hosting site
auramatrixa[.]com	1st Stage payload hosting site
zealpraxis[.]com	1st Stage payload hosting site
prism-vertex[.]com	1st Stage payload hosting site
prism-matrixs[.]com	1st Stage payload hosting site
proton-network[.]com	1st Stage payload hosting site
creativecommunityinfo[.]art	Payload hosting site

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide