Threats Tagged 'acr stealer'

Between late April and mid-June 2026, Microsoft observed increased activity of ACR Stealer malware targeting enterprise environments via ClickFix social engineering lures. The malware, linked to Amatera Stealer rebranding and offered as malware-as-a-service, was deployed through two distinct campaigns: one using WebDAV-delivered Python loaders with blockchain-based command-and-control, and another using fileless techniques with MSHTA and steganography-concealed payloads. The campaigns harvested browser credentials, authentication tokens, and sensitive documents, employing obfuscated PowerShell scripts, scheduled tasks, and in-memory execution to evade detection. Notable tactics included masquerading as legitimate software updates and leveraging Windows DPAPI for credential decryption.