Full research report

ACR Stealer: Two observed intrusion chains amid increased threat activity

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

ACR Stealer's 2026 campaigns represent the maturation of a well-established MaaS family rather than an entirely new threat: the EtherHiding blockchain C2 and WebDAV DLL-loading tradecraft documented by Microsoft in April–June 2026 were already observable in independent live-case research from March 2026, and Proofpoint had documented the same techniques in ClearFake campaigns a year earlier. The two intrusion chains differ primarily in staging — one disk-resident with Python loaders and scheduled task persistence, the other entirely fileless via MSHTA and in-memory steganographic loading — but both converge on DPAPI-assisted Chromium credential theft and document exfiltration as the terminal objective. No CVEs underpin either chain, which limits the defensive value of patch management and elevates the importance of ASR rules, application control over MSHTA and PowerShell, and network-layer blocking of WebDAV and blockchain RPC traffic. The MaaS model means campaign operators are likely distinct from the malware authors, and the absence of specific actor attribution leaves the threat actor landscape for this family unresolved despite the high technical confidence in the campaign descriptions.

What happened

From late April to mid-June 2026, Microsoft Defender Experts observed a surge in ACR Stealer deployments across enterprise customer environments, identifying two distinct intrusion chains. Both begin with ClickFix social engineering — tricking users into manually executing attacker-supplied commands via malvertising or SEO-poisoned search results — then diverge markedly in payload delivery. ACR Stealer is a credential-harvesting malware-as-a-service (MaaS) family reportedly rebranded from, or closely related to, Amatera Stealer, which itself emerged after ACR sales were suspended in July 2024. Proofpoint independently documented the same malware family using EtherHiding-based blockchain C2 and ClearFake web injects in April–May 2025, confirming a documented lineage prior to the 2026 campaigns.

Affected scope

Enterprise Windows users reached via malvertising and SEO-manipulated search results. Chromium-based browsers are the primary credential store targets. Microsoft 365 documents, OneDrive, and SharePoint data are enumerated for exfiltration staging. No specific sector or geography is identified as exclusively targeted in available reporting.

Technical assessment

Campaign 1 abuses the Windows WebDAV client via rundll32.exe to load a DLL from a remote HTTPS-hosted share with GUID-based path structures, then stages Python-based loaders with hidden scheduled task persistence. C2 resolution in some intrusions uses the EtherHiding technique: querying Binance Smart Chain smart contracts for dynamic payload or C2 updates, making infrastructure takedown significantly harder. Campaign 2 takes a fileless approach: MSHTA spawns VBScript that decodes obfuscated PowerShell, which fetches a JPEG image carrying the encrypted payload encoded within pixel colour channel values; custom routines decrypt and decompress the payload entirely in memory via dynamic API resolution and reflective shellcode loading. Both chains terminate with Windows DPAPI decryption of Chromium credential databases and systematic file collection from common document locations prior to exfiltration.

Recommended defensive actions

  1. Enable Microsoft Defender for Endpoint Attack Surface Reduction (ASR) rules — particularly rules blocking untrusted DLL execution via rundll32 and execution from WebDAV paths — which stop Campaign 1's entire downstream chain at initial execution.
  2. Restrict MSHTA execution via application control policy (e.g., AppLocker or WDAC); alert on MSHTA spawning PowerShell or initiating outbound network connections.
  3. Enable PowerShell script block logging and AMSI telemetry; build detection logic for highly obfuscated scripts containing arithmetic no-ops, dead-code loops, and chained Base64-plus-zlib encoding.
  4. Block or alert on outbound workstation connections to public blockchain RPC endpoints (Binance Smart Chain nodes) — a strong behavioural indicator of EtherHiding-based C2 activity.
  5. Hunt for scheduled tasks created at user logon that invoke Python interpreters, WebDAV UNC paths, or heavily encoded command lines; these are a persistence indicator for Campaign 1.
  6. Inspect and block WebDAV connections over HTTPS at the network boundary; the GUID-based directory structure and filenames mimicking legitimate resources (e.g., 'google.ct') are characteristic Campaign 1 delivery artefacts.
  7. Deploy the IoC blocklists published in the Microsoft advisory for both campaign infrastructure sets across DNS, proxy, and endpoint controls.

Uncertainties and evidence gaps

  • No specific threat actor group or criminal organisation has been attributed to either campaign; the MaaS model means malware authors and campaign operators are likely distinct and unidentified parties.
  • The full scale of enterprise compromise is unknown; Microsoft's telemetry is limited to Defender Experts customer environments.
  • Additional ACR Stealer delivery methods beyond these two campaigns are likely active, per Microsoft's explicit caveat — the reported chains are representative, not exhaustive.
  • Whether Amatera Stealer and ACR Stealer are currently the same MaaS offering, parallel competing offerings, or operated by different affiliates remains unclear; Proofpoint describes Amatera as a rebrand, but ACR-branded campaigns continued into 2026.
  • The EtherHiding blockchain infrastructure documented in the March 2026 Lindensec case may or may not overlap with the April–June 2026 Microsoft-documented campaigns; this is plausible but not confirmed.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser interaction required; victim must manually execute a pasted command presented via a ClickFix social engineering lure (fake CAPTCHA, fake verification prompt, or malvertising overlay) on a web page.
ComponentWindows shell execution environment (cmd.exe, rundll32.exe, MSHTA, PowerShell) and Chromium browser credential storage (SQLite databases protected by Windows DPAPI).
MechanismThe pasted command invokes either rundll32 to load a remote DLL over WebDAV (Campaign 1) or MSHTA to retrieve and execute remote HTA content containing VBScript (Campaign 2); subsequent stages decode, decompress, and execute payloads entirely in memory via Windows API calls for code injection and reflective loading, minimising disk artefacts.
ImpactTheft of browser-stored credentials, session cookies, and authentication tokens; enumeration and staging of enterprise documents; potential for account compromise, unauthorised cloud resource access, and further downstream intrusion.
DetectionSuspicious child processes from rundll32 or MSHTA (particularly spawning PowerShell or Python); outbound WebDAV or blockchain RPC connections from workstations; logon-triggered scheduled tasks referencing obfuscated command lines or Python runtimes; DPAPI invocation by non-browser processes accessing Chromium database files.
MitigationEnforce ASR rules blocking untrusted DLL execution and WebDAV payload loading; restrict MSHTA via application control; block outbound connections to the C2 domains and blockchain RPC endpoints listed in the Microsoft advisory; patch detection gaps with PowerShell and AMSI logging.
Exploitation status

Active exploitation confirmed across enterprise environments from late April to mid-June 2026; no CVE dependency — delivery relies entirely on ClickFix social engineering and living-off-the-land Windows binaries.

Research process

The investigation began with the Microsoft Defender Experts blog post as the sole source material and proceeded to verify its claims through independent research. The Proofpoint Amatera Stealer report confirmed the malware family's MaaS lineage and documented the same EtherHiding C2 technique in prior campaigns. The Lindensec March 2026 live-case analysis directly corroborated Campaign 1 tradecraft, while the Huntress steganography research matched Campaign 2's MSHTA-plus-pixel-encoded-payload chain. No CVEs were identified at any stage, and no dedicated government advisory for ACR Stealer was found, though the absence of a CISA advisory does not diminish confidence in the primary reporting.

  1. Does the primary Microsoft source exist, and does it substantiate the story as described in the supplied article text?
    Fetched the Microsoft Security Blog post at the URL provided in the source material.
    microsoft.com ↗

    Page confirmed and fully readable. Detailed two distinct ClickFix-initiated ACR Stealer campaigns observed April–June 2026: Campaign 1 using WebDAV, Python loaders, and EtherHiding blockchain C2; Campaign 2 using MSHTA, steganography, and fileless in-memory execution. IoC sets, MITRE ATT&CK mapping, and detection guidance all present.

    why Primary source established the event timeline, both intrusion chain descriptions, and IoC sets, providing the factual baseline against which all subsequent research was calibrated.

  2. Is there independent corroboration of ACR Stealer or Amatera Stealer as a MaaS offering, and of its connection to EtherHiding-based distribution?
    Searched for 'ACR Stealer Amatera Stealer MaaS 2026 blockchain C2 EtherHiding'.

    Multiple independent sources — Proofpoint, SC Media, CyberSecurityNews, SecurityOnline — confirmed Amatera Stealer as a C++ MaaS rebranding of ACR Stealer with EtherHiding-based ClearFake distribution documented in 2025. ACR Stealer sales were suspended in July 2024; Amatera first appeared December 2024.

    why Corroborates the malware family identification in the Microsoft report and establishes a prior documented activity baseline before the 2026 campaign window.

  3. Does the Proofpoint Amatera Stealer report provide specific technical detail that supports or contradicts the Microsoft report?
    Fetched the Proofpoint blog post on Amatera Stealer.
    proofpoint.com ↗

    Confirmed the malware lineage and MaaS model. EtherHiding via Binance Smart Chain, ClearFake web injects, ClickFix delivery, NTSockets for C2, WoW64 syscalls, AMSI/ETW bypass, and App Bound Encryption bypass all documented independently. No CVEs referenced.

    why Provides a reliable, independent technical baseline confirming EtherHiding as an established technique for this malware family — not a novel claim — and corroborates the absence of CVE-based exploitation.

  4. Is there independent live-case evidence of the EtherHiding + WebDAV + rundll32 ClickFix chain described in Campaign 1?
    Fetched the Lindensec analysis of a live ClickFix attack using EtherHiding and WebDAV.
    lindensec.com ↗

    March 2026 live case confirmed: rundll32 loading DLL over WebDAV from a BSC-contract-resolved domain, Python stealer staging, 277 days of active campaign operations. Correlated with UNC5142/CLEARSHORT activity documented by Google Threat Intelligence Group and Mandiant.

    why Directly corroborates Campaign 1 tradecraft and demonstrates the technique was active in the wild prior to April 2026, supporting the interpretation that Microsoft observed an ongoing, established campaign rather than a novel one.

  5. Is there independent research corroborating Campaign 2's MSHTA-initiated steganographic payload delivery chain?
    Searched for 'ACR Stealer ClickFix MSHTA steganography PowerShell infostealer 2026', then fetched the Huntress steganography analysis.
    huntress.com ↗

    Huntress documented ClickFix → MSHTA → PowerShell → PNG steganography → in-memory shellcode chain in October 2025, delivering LummaC2 and Rhadamanthys. The technique of encoding shellcode in PNG pixel Red channel values with XOR decryption matches the Campaign 2 mechanism described by Microsoft.

    why Confirms the steganographic payload delivery technique is independently documented in related ClickFix campaigns; its specific application to ACR Stealer in 2026 is sourced solely from Microsoft, but the technique itself is externally verified.

  6. Are there any government advisories (CISA, ACSC, etc.) specifically addressing ACR Stealer or this class of ClickFix infostealer activity?
    Searched for 'CISA advisory ClickFix infostealer 2026 ACR Stealer'.

    No CISA advisory specifically addressing ACR Stealer was found. CISA has referenced ClickFix in the context of Interlock ransomware (AA25-203A). The Australian ACSC issued a ClickFix advisory for Vidar Stealer in May 2026. No dedicated government advisory for ACR Stealer exists in current public records.

    why The absence of a government advisory is a material gap in the defensive landscape that organisations cannot assume means lower risk; it indicates that institutional alerting has not yet caught up with this specific threat family.

Named in this story
ActorsUnknown MaaS operators (ACR Stealer / Amatera Stealer authors and affiliates; no named group attributed)
MalwareACR StealerAmatera StealerSharkClipper
TargetsEnterprise Windows environmentsChromium-based browser credential stores (Chrome, Edge)Microsoft 365 / OneDrive / SharePoint document holdings

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
Microsoft Securitynews ok2 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied a vendor or government advisory opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok256 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok8 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vendor & gov advisories1
ACR Stealer: Two observed intrusion chains amid increased threat activity | Microsoft Security Blog microsoft.com ↗

Primary vendor report from Microsoft Defender Experts; includes IoC sets, MITRE ATT&CK mapping, and detection guidance for both campaigns.

Analysis & research3
Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication | Proofpoint proofpoint.com ↗

Independent technical analysis confirming the ACR-to-Amatera malware lineage, MaaS model, EtherHiding C2 technique, and NTSockets/WoW64 syscall evasion.

Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day | Lindensec lindensec.com ↗

March 2026 live-case analysis of EtherHiding + rundll32/WebDAV ClickFix chain that directly corroborates Campaign 1 tradecraft; notes UNC5142/CLEARSHORT correlation.

ClickFix Gets Creative: Malware Buried in Images | Huntress huntress.com ↗

Independent breakdown of MSHTA → PowerShell → PNG steganography → in-memory shellcode chain matching Campaign 2 technique, including XOR/pixel-channel extraction method.