ACR Stealer is an information-stealing malware associated with the Amatera Stealer rebranding and distributed as malware-as-a-service. Microsoft observed two distinct intrusion chains between late April and mid-June 2026 targeting enterprise environments using ClickFix social engineering lures. The first campaign delivered payloads via WebDAV with Python loaders and used blockchain-based command-and-control resolution. The second campaign used a fileless approach involving MSHTA and payloads concealed via steganography in images. Both campaigns focused on harvesting browser credentials, authentication tokens, and sensitive documents including PDFs and Microsoft 365 files. The threat actors used obfuscated PowerShell scripts, scheduled task persistence, and in-memory execution to avoid detection. They also masqueraded as legitimate software updates and exploited Windows DPAPI to decrypt credentials. The blockchain dead-drop technique enabled dynamic infrastructure for command-and-control.

The malware campaigns resulted in the theft of browser credentials, authentication tokens, and sensitive documents from compromised enterprise systems. This could lead to unauthorized access to user accounts and sensitive corporate data. The use of obfuscation, fileless techniques, and in-memory execution increases the difficulty of detection and remediation. The targeting of PDF and Microsoft 365 documents may expose confidential business information. The dynamic blockchain-based command-and-control infrastructure complicates traditional network defense measures.

No official patch or fix is available as this is malware activity rather than a software vulnerability. Organizations should refer to the Microsoft advisory for detailed detection and mitigation guidance. Mitigation should focus on identifying and blocking the associated domains and indicators of compromise, monitoring for suspicious PowerShell activity and scheduled tasks, and educating users to recognize and avoid ClickFix social engineering lures. Because the malware uses sophisticated evasion techniques including fileless execution and steganography, endpoint detection and response solutions with behavioral analysis capabilities are recommended. Regular credential resets and multi-factor authentication can reduce impact from stolen credentials.