ACR Stealer Malware Uses WebDAV and MSHTA to Bypass Enterprise Defences

A New Wave of ACR Stealer Malware Is Targeting Enterprise Credentials

Microsoft has issued a significant warning about a sharp rise in ACR Stealer malware activity, with two distinct attack campaigns observed between late April and mid-June 2026. The campaigns use a technique known as ClickFix — a form of social engineering that tricks users into executing malicious commands themselves — to steal browser credentials, session tokens, and sensitive business documents. Critically, neither campaign exploits any known software vulnerability. The entire attack hinges on deceiving the end user, making it one of the most difficult threat categories for traditional defences to catch.

The campaigns were documented in detail by Microsoft's security research team, who noted that while both attacks share the same ultimate objective — credential and data theft — they use divergent execution chains designed to confuse incident responders and evade detection tools calibrated for a single known attack pattern. For IT decision makers, privacy professionals, and small business owners relying on cloud infrastructure, the implications are serious: once ACR Stealer is deployed, attackers can access cloud services, impersonate legitimate users, and move laterally across enterprise environments.

ACR Stealer is classified as an information-stealing malware family and is believed by Microsoft to be distributed through a malware-as-a-service (MaaS) model, with possible links to a related threat called Amatera Stealer. This commercial model means the malware is not operated by a single threat actor but potentially by dozens of buyers renting access to the tool — a factor that complicates attribution and accelerates the rate at which new campaigns appear. According to CSO Online, the surge in ACR Stealer activity reflects a broader industry trend where credential-theft tools are commoditised and deployed at scale across diverse targets.

How the Two Attack Chains Differ — and Why That Matters for Defenders

The first campaign chain relies on WebDAV-hosted dynamic link libraries (DLLs), PowerShell scripts, Python-based loaders, and scheduled-task persistence mechanisms. It also incorporates a technique known as "EtherHiding," which uses blockchain-based infrastructure to conceal command-and-control (C2) server addresses. Because blockchain transactions are immutable and public, defenders cannot simply take down a domain to disrupt communications — the attacker's instructions remain accessible as long as the blockchain exists. This makes infrastructure takedown, a common incident response tactic, far less effective.

The second chain takes a markedly different approach. It uses MSHTA (Microsoft HTML Application host), a legitimate Windows binary, combined with heavily obfuscated PowerShell and steganography — the practice of hiding malicious payloads inside image files. Crucially, this chain is predominantly fileless: the malware executes almost entirely in memory, leaving minimal traces on disk for forensic investigators to analyse. This directly undermines endpoint detection tools that rely on scanning files written to storage.

Nick Tausek, lead security automation architect at Swimlane, explained the strategic logic behind this dual-chain approach: by varying the delivery and execution patterns, attackers can defeat defences calibrated to detect a single known chain. Security operations centre (SOC) teams may log the two campaigns as separate, unrelated incidents — failing to recognise they share the same malware family and the same underlying objective until significant damage has already been done.

This is not merely a technical curiosity. For organisations with lean security teams — including many European SMEs and startups — the cognitive overhead of correlating two seemingly unrelated incidents can be the difference between catching an intrusion early and discovering it weeks later after credentials have been monetised or data has been exfiltrated.

What Is ClickFix, and Why Is It So Effective Against Users?

ClickFix is a social engineering technique that presents users with a fake error message or technical problem — typically in a browser window or document — and instructs them to run a command to "fix" the issue. The commands are pre-populated for the user to paste into a Windows Run dialog or PowerShell terminal, making exploitation trivially easy even for non-technical users. It requires no malicious attachment, no drive-by download exploit, and no software flaw. The user becomes the unwitting executor of the attack.

According to research tracked by BleepingComputer, ClickFix attacks have become one of the fastest-growing delivery mechanisms for information stealers and remote access tools over the past eighteen months. The technique is particularly effective because it bypasses most email security gateways and endpoint protection tools — the malicious action is performed by the legitimate user account, using legitimate system tools.

For privacy-conscious organisations operating under GDPR, this attack vector carries specific regulatory risk. When an employee executes a ClickFix payload and ACR Stealer extracts browser-stored credentials and session tokens, the resulting data breach may trigger notification obligations under Article 33 of the GDPR — requiring notification to the relevant supervisory authority within 72 hours. If the stolen data includes customer personal data, Article 34 may also require direct notification to affected individuals. The reputational and financial costs compound quickly.

What Data Does ACR Stealer Actually Steal — and Where Does It Go?

Understanding the scope of what ACR Stealer extracts helps prioritise the response. The malware targets browser-stored credentials across all major browsers, saved passwords and autofill data, session cookies and authentication tokens (which can allow attackers to impersonate logged-in users without knowing the password), and sensitive business documents stored locally or synced via cloud storage clients.

Session token theft is particularly alarming for organisations that have invested in multi-factor authentication (MFA). Because a valid session token represents an already-authenticated session, an attacker who possesses it can access cloud platforms — Microsoft 365, Google Workspace, AWS consoles, SaaS tools — without triggering MFA prompts. This effectively renders MFA useless as a protection against post-execution credential theft, a point that underscores why preventing initial execution is so critical.

Research from Microsoft's Security Blog confirms that protections against both ACR Stealer campaigns have now been added to Microsoft Defender for Endpoint, which can identify suspicious WebDAV activity, obfuscated PowerShell, MSHTA execution, scheduled-task persistence, in-memory payload execution, and browser credential access patterns.

Practical Defences Against ACR Stealer Malware Campaigns

Microsoft's official guidance recommends a layered approach. At the technical level, organisations should monitor for suspicious PowerShell activity (particularly encoded or obfuscated commands), MSHTA execution initiated from unusual parent processes, outbound WebDAV connections, and any process attempting to read browser credential stores. Enabling Microsoft Defender SmartScreen and configuring Attack Surface Reduction (ASR) rules can block many common delivery techniques before they reach the execution phase.

Microsoft also shared a list of command-and-control (C2) server addresses and payload hosting domains with defenders to add to blocklists and detection rules — a practical step that security teams should act on quickly before attackers rotate infrastructure. The company additionally released extended detection and response (XDR) queries to help teams identify ClickFix-style execution activity in their environments.