ACR Stealer Tricks Staff Into Typing the Attack Themselves

Key points

• Microsoft's Defender Experts team on Thursday detailed two delivery chains pushing ACR Stealer, an information-stealing program active since 2024.
• The malware grabs saved browser passwords, live login cookies, PDFs, Office documents and files synced from OneDrive and SharePoint.
• Infections start with ClickFix lures: fake error pages that tell the visitor to paste a command into the Windows Run box.
• Stolen session tokens let attackers log into cloud accounts without needing the password or the multi-factor code.
• Security vendors track ACR Stealer as a commodity tool sold to multiple criminal crews, so attribution to any single group is low confidence.

A data-stealing program called ACR Stealer is quietly walking out of company networks with the crown jewels: saved browser passwords, active login sessions, PDFs, Office files, and anything synced from OneDrive or SharePoint.

It gets in because someone pastes a command into a Windows box and hits Enter.

Microsoft's Defender Experts team published two delivery chains on Thursday. Both start the same way, with a technique called ClickFix.

What is ClickFix, in plain English?

ClickFix is a fake error page. The victim lands on a site, or opens an attachment, and sees a message that looks like a routine browser hiccup: "Something went wrong, run this to fix it." The page then gives step-by-step instructions to open the Windows Run dialog and paste in a line of text.

That line of text is the attack. It downloads and runs ACR Stealer the moment the victim presses Enter.

The reason it works is that the victim does the risky part themselves. There's no attachment to scan, no macro warning to dismiss. The malicious command lives on the clipboard for a second, then executes. We covered the broader ClickFix technique in depth on 14 July in "ClickFix: The Fake Error Pop-Up That Tricks You Into Hacking Yourself", which found that standard antivirus tools are missing it almost entirely.

What does ACR Stealer actually take?

An infostealer is a program built for one job: scrape everything valuable off a machine and send it back to the criminals. ACR Stealer, in circulation since 2024, is a capable example.

Microsoft says it lifts saved passwords from browsers including Chrome and Edge, session cookies that keep you logged into accounts like Microsoft 365 or a bank, local documents including PDFs and Office files, and anything sitting in a OneDrive or SharePoint folder the machine has synced to disk.

That last point matters. Many staff treat OneDrive as a safe cloud vault. If it's syncing to the laptop, ACR sees it as a normal folder and copies what it wants. Stolen session cookies are the sharper risk: hand one of those to a criminal and they can often walk straight into the account, skipping both the password and the multi-factor prompt.

Who is behind it?

Honest answer: nobody is naming a single group with confidence. ACR Stealer is a commodity tool sold on criminal forums, and multiple crews use it. The Hacker News, which first flagged the Microsoft write-up, notes the same lure family has been seen pushing several different payloads over the past year.

ClickFix as a technique has overlapping usage across financially motivated crews and at least one cluster with suspected state-linked interests. Same TTP, different hands. Treat any single-source attribution with caution.

Should you worry?

One rule covers most of it. No legitimate website or IT team will ever ask you to open the Run box and paste in a command to fix a page. If a site tells you to do that, close the tab.

If you think you already did it, tell your IT team the same day. Changing your password isn't enough on its own, because the stolen session cookie may still be valid. The account needs to be signed out everywhere and the tokens revoked.

For home users, the same logic applies to fake CAPTCHA pages and "verify you are human" prompts asking you to press Windows-R. That's the attack, not a human check.