ACR Stealer uses ClickFix lures to take browser tokens and OneDrive files

Microsoft documented rising ACR Stealer activity in enterprise networks between late April and mid-June 2026, delivered by ClickFix lures reached through malvertising and poisoned search results, some impersonating well-known AI services.

The lure persuades the user to paste a command into the Windows Run dialog. From there Microsoft describes two chains: one running largely in memory via mshta.exe, pulling remote HTA content with payloads hidden in image pixels, and another fetching a DLL from a WebDAV share, then running obfuscated PowerShell that drops Python for persistence.

What leaves is the part that matters for identity. Browser passwords and session tokens from Chrome and Edge, cookies decrypted through DPAPI, PDFs from Desktop and Downloads, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders.

Why it matters

An infostealer that takes live session cookies has stolen authenticated access, not credentials. Resetting the password does nothing, because the attacker never needed it. This is the mechanism behind a long run of "but we had MFA" incidents, and our infostealer teardown covers how the resulting sessions get used.

Two practical points. First, on any host you believe was compromised, revoke tokens, do not merely rotate passwords. Second, note that the initial access is a user pasting a command into Run, which is cheap to remove: disable the Run prompt by Group Policy, block mshta.exe, rundll32.exe, and Python through AppLocker or WDAC, and apply attack-surface-reduction rules against internet-delivered content. Then hunt for scheduled tasks dressed as software updaters. None of that is identity work, which is exactly why it tends to go unowned when the consequence lands on the identity team.

Source: The Hacker News