Full research report

Microsoft warns of surge in ACR Stealer attacks on customers

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

ACR Stealer is a well-documented MaaS information stealer operating under multiple brand names since 2023, and the 2026 campaign represents an increase in delivery tempo rather than a novel capability set. The ClickFix initial-access technique has become the dominant entry vector across multiple threat families precisely because it requires no exploitable vulnerability and instructs the victim to use trusted Windows system utilities — making it resistant to most signature-based and automated defences. The EtherHiding sub-technique is particularly significant: because C2 addresses are embedded in immutable smart contracts on public blockchain networks, domain takedowns and sinkholing are ineffective, shifting the defensive requirement entirely to endpoint execution control. eSentire's analysis of Amatera 4.0.2 demonstrates that the underlying codebase is actively maintained, with hardened encryption replacing a previously hardcoded key and AMSI bypass techniques that will degrade the reliability of common EDR hooking mechanisms. The operator identity post-SheldIO remains the most material open question: whether one actor or multiple buyers of the sold source code are responsible for the 2026 activity affects how defenders should model future delivery evolution and targeting decisions.

What happened

Between late April and mid-June 2026, Microsoft Defender Experts observed a significant surge in ACR Stealer activity targeting enterprise customers, documented in a vendor advisory published 16 July 2026. Two distinct delivery chains were identified, both beginning with ClickFix social-engineering lures that trick users into manually executing attacker-controlled commands from a Run dialog or command interpreter. ACR Stealer is a malware-as-a-service family traceable to the SheldIO operator (who retired in July 2024) and was rebranded as Amatera Stealer in June 2025 with enhanced evasion capabilities. Red Canary's independent telemetry independently ranked the family sixth in prevalence across their customer base in April 2026, corroborating the scale of activity Microsoft describes.

Affected scope

Enterprise Windows environments using Chromium-based browsers (Chrome, Edge) with credentials stored in browser profiles; organisations with OneDrive or SharePoint document synchronisation; environments without application controls restricting mshta.exe, rundll32.exe, PowerShell, or Python execution from user-writable or remote paths. No specific sector or geographic targeting was identified in any reviewed source; Microsoft reports across its broad enterprise customer base.

Technical assessment

Two intrusion chains diverge after the ClickFix initial step. The first mounts a remote WebDAV share and loads a DLL via rundll32.exe, then stages a Python-based loader through obfuscated PowerShell, establishes persistence via a hidden scheduled task disguised as a software update, performs timestomping and PowerShell history clearing, and executes the final payload in memory using the Windows Fiber API. Some variants resolve C2 addresses through smart contracts on public blockchain networks (the EtherHiding technique), making infrastructure takedown ineffective as the payload location is stored in immutable on-chain data. The second chain uses MSHTA to retrieve and execute VBScript, which downloads an encrypted payload concealed within a publicly hosted steganographic JPEG and executes it entirely in memory via reflective shellcode through CreateThread. Both chains exfiltrate data by using Windows DPAPI to decrypt Chromium credential stores and access session cookies and authentication tokens.

Recommended defensive actions

  1. Block mshta.exe execution using AppLocker or Windows Defender Application Control (WDAC) policies — this severs the MSHTA-based chain at its first execution step
  2. Enable and enforce Attack Surface Reduction (ASR) rules in block mode (not audit mode), particularly those preventing rundll32.exe from loading remote DLLs and blocking executable content sourced from remote or user-writable paths
  3. Restrict PowerShell, Python, mshta.exe, and rundll32.exe from launching content from user-writable paths (Downloads, Temp, AppData) or remote UNC/WebDAV shares via Group Policy or WDAC
  4. Train users to recognise ClickFix lures: no legitimate service instructs users to open Run (Win+R) and paste commands; consider removing the Run dialog via Group Policy for high-risk user populations
  5. On suspected compromise, revoke all active browser sessions and authentication tokens rather than rotating passwords alone — stolen session cookies bypass credential-only controls
  6. Hunt for rundll32.exe making network connections without command-line arguments; alert on scheduled tasks with software-update display names created from PowerShell; flag outbound connections to public blockchain RPC endpoints (drpc.org, bnbchain.org) from non-developer workstations

Uncertainties and evidence gaps

  • The threat actor or group operating ACR Stealer after SheldIO's July 2024 exit is unknown; current operator identity is unconfirmed across all reviewed sources
  • Linkage to UNC5142/CLEARSHORT comes from a single independent technical blog (Lindensec) based on infrastructure overlaps and is not corroborated by Microsoft or other primary sources
  • Microsoft explicitly states that additional delivery chains beyond the two documented are very likely to exist; the full delivery-method landscape is unknown
  • Victim count and breadth of affected organisations have not been disclosed; Microsoft's advisory references 'customer environments' without quantification
  • Whether post-sale ACR Stealer and Amatera Stealer variants are operated by the same actor or by distinct buyers of the sold source code remains uncertain

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNo system vulnerability required; initial execution is obtained through user interaction with a ClickFix social-engineering lure delivered via malvertising or SEO-manipulated search results
ComponentWindows user session — the Run dialog, command interpreters (cmd.exe, PowerShell), and Living-off-the-Land binaries (mshta.exe, rundll32.exe) available to standard users without elevated privilege
MechanismClickFix presents a fake browser error or CAPTCHA that pre-stages a command in the clipboard; the user is instructed to open Run or a terminal and paste it, causing trusted Windows system utilities to fetch and execute attacker-controlled code from remote WebDAV shares or MSHTA-served HTA content without a dropped executable visible to basic endpoint controls
ImpactFull theft of browser-stored credentials, cookies, and session tokens; DPAPI-decrypted access to Chromium Login Data and Web Data databases; collection of enterprise documents from OneDrive and SharePoint; persistent scheduled task enabling re-access after initial session ends
Detectionrundll32.exe making network connections without command-line arguments; powershell.exe or python.exe spawned from rundll32.exe or mshta.exe; scheduled tasks with software-update display names created via PowerShell; outbound connections to public blockchain RPC endpoints from enterprise workstations; JPEG file downloads followed by in-memory execution; RunMRU registry writes referencing rundll32, mshta, or UNC paths
MitigationNo patch applicable (no CVE); mitigation requires application control blocking mshta.exe and remote DLL loading via rundll32.exe, ASR rules enforced in block mode, user education on ClickFix lures, and web content filtering blocking low-reputation or newly registered domains
Exploitation status

Active exploitation confirmed; Microsoft Defender Experts observed enterprise customer compromises between late April and mid-June 2026; no CVEs are involved — delivery relies entirely on ClickFix social engineering; no public proof-of-concept for the delivery chains themselves.

Research process

The investigation began with a BleepingComputer report citing a Microsoft warning, which led directly to Microsoft's own Security Blog advisory as the primary source. Independent corroboration was obtained from The Hacker News, Red Canary's monthly telemetry digest, eSentire's Amatera technical analysis, Malpedia's malware taxonomy, and a Lindensec SOC dissection — each contributing distinct factual dimensions not present in the others. The investigation confirmed no CVEs are associated, that exploitation is socially engineered rather than vulnerability-based, and that the MaaS infrastructure traces to SheldIO's ACR Stealer with post-sale rebranding as Amatera Stealer under an operator who remains unidentified.

  1. What are the full facts in the BleepingComputer source article?
    Fetched the BleepingComputer article directly to verify and expand on the untrusted source material
    bleepingcomputer.com ↗

    Confirmed campaign dates (late April to mid-June 2026), two delivery chains, data exfiltration targets, and recommended mitigations; no CVEs cited; ACR Stealer described as a likely Amatera Stealer rebranding

    why Established the event baseline and verified the untrusted article content before treating any claim as a research lead

  2. Does Microsoft have a primary advisory and what technical depth does it provide?
    Searched for and fetched the Microsoft Security Blog post directly
    microsoft.com ↗

    Full advisory confirmed: 16 IoC domains, three XDR hunting queries, MITRE ATT&CK mappings for 13 techniques, detailed chain descriptions including Windows Fiber API and DPAPI use, and an explicit statement that additional delivery methods are likely

    why Microsoft is the reporting vendor; this is the highest-authority primary source and the factual anchor for the entire assessment

  3. Is there independent corroboration from a separate security organisation, and what additional context does it add?
    Fetched The Hacker News coverage of the ACR Stealer campaign
    thehackernews.com ↗

    Independently confirmed all key facts; added historical timeline (SheldIO exit July 2024, Amatera rebranding June 2025), MaaS pricing ($199–$1,499/month), and Red Canary's April 2026 prevalence ranking of 6th

    why Provides a second independent domain confirming the event and adds historical lineage critical to understanding operator uncertainty and MaaS ecosystem context

  4. What is the established malware taxonomy for ACR Stealer and which research organisations have tracked it?
    Fetched the Malpedia malware family record for win.acr_stealer
    malpedia.caad.fkie.fraunhofer.de ↗

    Confirmed MaaS origin March 2024, SheldIO attribution, dead-drop resolver technique, GrMsk Stealer lineage, and a research reference trail including Fortinet, Proofpoint, Cyble, and Swisscom B2B CSIRT through May 2026

    why Malpedia provides taxonomy-level corroboration and a multi-organisation research trail confirming this family has been independently tracked for over two years

  5. What does Red Canary's independent telemetry say about ACR Stealer prevalence and detection?
    Fetched Red Canary's May 2026 Intelligence Insights report
    redcanary.com ↗

    ACR Stealer ranked 6th in April 2026 prevalence; delivery via fake Claude Code GitLab pages documented; rundll32.exe without command-line arguments making network connections identified as a high-fidelity detection signal

    why Provides independent prevalence quantification from a distinct telemetry source and a concrete detection opportunity absent from the Microsoft advisory

  6. What technical changes does Amatera Stealer introduce relative to ACR Stealer, and how does this affect detection and response?
    Fetched eSentire's analysis of Amatera Stealer 4.0.2 Beta
    esentire.com ↗

    Confirmed ACR-to-Amatera rebranding; C2 communications now use ECDH key exchange with ChaCha20-Poly1305 replacing a hardcoded AES-256-CBC key; AMSI bypass via RecycledGate SysCall technique; browser targets expanded from 37 to 65, desktop wallet targets tripled to 137

    why Establishes that current variants carry significantly stronger evasion than original ACR Stealer, making credential-based sandbox detection and older YARA rules less reliable

  7. Is there a technical dissection of the EtherHiding sub-technique with infrastructure-level detail and actionable detection logic?
    Fetched Lindensec's technical dissection of a live ClickFix attack using EtherHiding and WebDAV
    lindensec.com ↗

    Detailed Binance Smart Chain testnet contract architecture with specific contract addresses; Yandex Metrika tracking for victim analytics; ASR rule in block mode stopped execution; KQL hunting queries provided; linkage to UNC5142/CLEARSHORT noted based on Google/Mandiant infrastructure overlap

    why Provides the deepest technical detail on EtherHiding's architecture and explains why infrastructure takedowns are ineffective; UNC5142 attribution is treated as a single-source claim and noted as uncertain

Named in this story
ActorsSheldIO (original MaaS operator; ceased sales July 2024, source code subsequently sold)UNC5142 / CLEARSHORT (linked to overlapping EtherHiding infrastructure by Lindensec citing Google/Mandiant; not corroborated by Microsoft)
MalwareACR StealerAmatera StealerAcridRainGrMsk Stealer
TargetsEnterprise organisations (Microsoft customer base, no sector specified)Chromium-based browser users (Chrome, Edge)OneDrive and SharePoint environmentsMicrosoft 365 document stores

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok empty0 records Primary evidence1 matched items Published the source report used to frame and date the event.
Microsoft Securitynews ok empty0 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok257 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok6867 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok6 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
PoC & exploit code1
Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day lindensec.com ↗

Hands-on SOC dissection of the WebDAV/EtherHiding chain including blockchain contract addresses, Yandex Metrika tracking, and KQL detection queries

Vendor & gov advisories1
ACR Stealer: Two observed intrusion chains amid increased threat activity — Microsoft Security Blog microsoft.com ↗

Primary vendor advisory; includes 16 campaign IoC domains, MITRE ATT&CK mappings for 13 techniques, and three Defender XDR hunting queries

OSINT / dark-web chatter1
ACR Stealer (Malware Family) — Malpedia malpedia.caad.fkie.fraunhofer.de ↗

Taxonomy record corroborating MaaS origin, SheldIO actor, DDR technique use, and research references from Fortinet, Proofpoint, Cyble, and Swisscom B2B CSIRT spanning April 2024 to May 2026

Analysis & research3
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files — The Hacker News thehackernews.com ↗

Independent coverage adding historical actor timeline, MaaS pricing ($199–$1,499/month), post-SheldIO operator uncertainty, and Red Canary prevalence context

Intelligence Insights: May 2026 — Red Canary redcanary.com ↗

Independent telemetry placing ACR Stealer 6th in April 2026 prevalence; documents ClearFake delivery and the rundll32-without-parameters-plus-network-connection detection signal

Amatera Stealer 4.0.2 Beta: What's New in This Variant — eSentire esentire.com ↗

Technical analysis of Amatera rebranding: ECDH/ChaCha20-Poly1305 replacing hardcoded AES-256-CBC, AMSI bypass via RecycledGate, expansion to 65 browsers and 137 desktop wallet targets