Microsoft Warns of Two ACR Stealer Campaigns Stealing Credentials Through Fake Fixes

Key points

• Microsoft identified two distinct ACR Stealer campaigns running from late April to mid-June 2026 that steal credentials, browser data, and business documents.
• Neither campaign exploited a software vulnerability; both relied entirely on social engineering to get victims to run malicious commands themselves.
• ACR Stealer is sold as a service to criminals, meaning multiple groups can buy and deploy it, and Microsoft believes it shares code with a related tool called Amatera Stealer.
• Microsoft has added detection coverage for both campaigns to its Defender security products and published a list of criminal server addresses for defenders to block.

Criminals stole workplace credentials and documents from businesses across two coordinated campaigns, Microsoft disclosed this week. The technique is called ClickFix: victims see a fake error message, are told to paste a command into their own computer to "fix" it, and that command silently installs the malware. No security flaw needed. Victims do the attacker's dirty work themselves.

We've covered ClickFix's growth into a thriving criminal marketplace in our 14 July piece, and first reported on this specific ACR Stealer surge on 17 July.

The malware at the centre is ACR Stealer. Once it runs, it pulls saved passwords, session tokens (small files that keep you logged into websites without re-entering your password), and documents. With those in hand, attackers can log into cloud services and impersonate the victim.

How did the criminals avoid being caught?

Two completely different delivery routes led to the same theft. One used WebDAV, a standard file-sharing protocol built into Windows, to fetch malicious code, then used scheduled tasks to keep the malware running after a restart. It also hid its command server inside the Ethereum blockchain, a technique researchers call "EtherHiding," making the criminal infrastructure harder to shut down.

The second route used a Windows tool called MSHTA to run heavily scrambled code and kept almost everything inside the computer's memory rather than writing files to disk, leaving fewer traces for investigators.

Nick Tausek, lead security automation architect at Swimlane, explained the logic to CSO Online: "By changing the delivery and execution patterns, attackers can evade defenses tuned to one known chain and make related incidents appear disconnected. Security teams may split the activity across separate investigations, delaying recognition of the shared malware and objective."

Two different-looking incidents. One criminal operation.

Microsoft's Defender for Endpoint now detects suspicious use of WebDAV, MSHTA, obfuscated PowerShell (a Windows scripting tool criminals frequently misuse), and attempts to read browser password stores. Enabling Defender SmartScreen and Attack Surface Reduction rules, which are preset policies that block common malware delivery methods, is also recommended.

Should your organisation act now?

Yes, and the first step costs nothing: tell staff that any prompt asking them to copy text into a Windows Run box or terminal is suspicious, full stop. IT teams should audit who runs PowerShell and MSHTA day-to-day and alert on unusual activity. Microsoft has published the criminal server addresses; network teams should add those to block lists immediately.

What this campaign shows, more than anything, is that the flexibility of a malware-as-a-service tool is a defence problem. Different buyers, different delivery chains, same payload. Signature-based tools won't see it coming.