Microsoft Warns of Two ACR Stealer Campaigns Stealing Credentials Through Fake Fixes
Between late April and mid-June 2026, two separate criminal campaigns used a trick called ClickFix to persuade workers to hand over browser passwords, session tokens, and business documents, with no software flaw required.
Key points
- Microsoft identified two distinct ACR Stealer campaigns running from late April to mid-June 2026 that steal credentials, session tokens, and business documents.
- Neither campaign exploited a software vulnerability; both relied entirely on social engineering to get victims to run malicious commands themselves.
- ACR Stealer is sold as a service to criminals, meaning multiple groups can buy and deploy it, and Microsoft believes it shares code with a related tool called Amatera Stealer.
- Microsoft has now added detection coverage for both campaigns to its Defender security products and published a list of criminal server addresses for defenders to block.
Criminals stole workplace credentials and documents from businesses across two coordinated campaigns, Microsoft disclosed this week. The thefts used a technique called ClickFix, where victims see a fake error message and are told to paste a command into their own computer to "fix" it. That command silently installs the malware.
No security flaw was used. The victim did the hard work for the attacker.
The malware at the centre of both campaigns is called ACR Stealer. Once it runs, it pulls saved passwords from the browser, session tokens (small files that keep you logged into websites without re-entering your password), and documents off the machine. With those in hand, criminals can log into cloud services and impersonate the victim.
How did the criminals avoid being caught?
They ran two completely different delivery routes to the same theft. One route used WebDAV, a standard file-sharing protocol built into Windows, to fetch the malicious code, then used scheduled tasks to keep the malware running after a restart. It also hid its command server inside the Ethereum blockchain, a technique researchers call "EtherHiding," making the criminal infrastructure much harder to shut down.
The second route used a Windows tool called MSHTA to run heavily scrambled code and kept almost everything inside the computer's memory rather than writing files to disk, leaving fewer traces for investigators.
Nick Tausek, lead security automation architect at Swimlane, explained the logic to CSO Online: "By changing the delivery and execution patterns, attackers can evade defenses tuned to one known chain and make related incidents appear disconnected. Security teams may split the activity across separate investigations, delaying recognition of the shared malware and objective."
Two different-looking incidents. One criminal operation.
Microsoft's Defender for Endpoint product now detects suspicious use of WebDAV, MSHTA, obfuscated PowerShell (a Windows scripting tool that criminals frequently misuse), and attempts to read browser password stores. Microsoft also recommends enabling Defender SmartScreen, which warns users before running unrecognised files, and Attack Surface Reduction rules, which are preset policies that block common malware delivery methods.
What should affected organisations do?
Start by telling staff about ClickFix. Any prompt that asks a user to copy text into a Windows Run box or a terminal should be treated as suspicious, full stop. IT teams should audit who runs PowerShell and MSHTA day-to-day and alert on unusual activity. Microsoft has published the criminal server addresses in its report; network teams should add those to their block lists immediately.
