ClickFix Campaign Distributes ACR Stealer to Harvest Browser Tokens and Microsoft 365 Credentials

Key Findings

• ACR Stealer, active since 2024, steals browser passwords, session tokens, PDFs, and Microsoft 365 documents through ClickFix social engineering lures

• Two distinct delivery chains identified: one leaves disk artifacts, the other operates entirely in memory using steganography and pixel-embedded payloads

• No vulnerabilities exploited; both chains rely entirely on victims pasting commands into Run boxes or PowerShell

• Microsoft recommends revoking tokens rather than rotating passwords due to stolen authentication credentials

• Some variants use blockchain RPC endpoints to retrieve payloads, a technique Microsoft calls EtherHiding

• Campaign successfully targeted enterprise environments from late April through mid-June with measurable increase in activity

Background

ACR Stealer is an infostealer that has been circulating since 2024, gaining notoriety for its effectiveness at extracting valuable data from compromised systems. Microsoft's Defender Experts team, which manages detection for enterprise customers, observed a sharp uptick in ACR Stealer activity across client environments between late April and mid-June. The campaigns proved particularly successful at using ClickFix lures, a social engineering technique that tricks users into manually executing malicious commands. Once installed, the malware systematically harvests browser credentials, authentication tokens, and sensitive business documents including PDFs and Microsoft 365 files from synced OneDrive and SharePoint folders.

The Fileless Delivery Chain

The more sophisticated of the two delivery chains operates almost entirely in memory, leaving minimal forensic traces for defenders. The attack begins when a user pastes a command that spawns mshta.exe to retrieve remote HTA content. An embedded VBScript loader uses COM objects to decode and execute PowerShell code without writing artifacts to disk.

Once running, PowerShell generates a unique victim ID, disables certificate validation checks, and retrieves what appears to be a seemingly innocent JPEG image from a public image hosting service. However, the actual payload is hidden within the image pixels using steganography. Custom decryption and decompression routines extract, decrypt, and reflectively execute the payload entirely in memory.

The malware then targets Chrome and Edge browsers, reading the Login Data and Web Data databases and invoking Windows DPAPI to decrypt stored passwords, cookies, and authentication tokens. Desktop and Downloads folders are searched for PDF documents and other sensitive files.

The Disk-Based Delivery Chain

The first delivery chain writes artifacts to disk, providing defenders with more forensic evidence but remaining effective nonetheless. A pasted command directly downloads a DLL from a WebDAV share over HTTPS, using a GUID-based directory structure and filenames designed to appear legitimate, such as google.ct.

Two variants use the pushd command to mount the remote WebDAV share as a temporary local drive letter, allowing the payload to execute through what appears to be a local file path. The stealthiest variant wraps execution in conhost.exe --headless to suppress console windows and hides critical strings behind delayed environment variable expansion to evade detection.

Following initial execution, obfuscated PowerShell drops a ZIP file into a temporary folder under %LocalAppData%\Temp with an innocuous name like LogiOptionsPlus. A bundled pythonw.exe then launches a Python script without displaying any visible windows. The installer removes older copies before installing new ones, effectively functioning as an updater. Persistence is maintained through a hidden scheduled task masquerading as a software update, file timestamps are copied from legitimate system files like notepad.exe, and PowerShell history is cleared to eliminate traces.

The final execution stage remains in memory and uses the Windows Fiber API to hand off execution, further complicating analysis.

Social Engineering and Initial Access

The ClickFix prompts likely arrive through malvertising or search engine optimization manipulation targeting popular search results. One documented chain impersonated Claude, Anthropic's AI assistant, using malicious Google ads that often redirected through sites.google.com URLs. The lure pages served macOS-specific instructions when opened on Mac devices and Windows instructions when opened on Windows systems.

Red Canary documented similar Claude-branded lures delivered through fake Claude Code pages hosted on GitLab, such as claude-desktop[.]gitlab[.]io. These campaigns began appearing at least a month before Microsoft's public analysis, suggesting the infrastructure and tactics have been refined over time.

Steganography and Blockchain Obfuscation

A particularly innovative aspect of ACR Stealer involves embedding payloads within image pixels, making detection through traditional network monitoring extremely difficult. When the JPEG is retrieved, custom routines carve out the hidden data, decrypt it, decompress it, and execute it reflectively without touching disk.

In a subset of intrusions, a secondary Python loader communicates with public blockchain RPC endpoints and Web3 node infrastructure. Microsoft identifies this technique as EtherHiding: attackers embed payload or command and control addresses within smart contracts on public blockchains. This approach effectively eliminates traditional attacker-controlled domain resolvers that defenders can seize, creating a nearly unstoppable delivery mechanism.

Lack of Vulnerability Exploitation

Critically, neither delivery chain exploits any software vulnerabilities. Both chains inherit whatever permissions the signed-in user already possesses. Every layer of the attack chain, from WebDAV mounting to pixel extraction to in-memory execution, functions solely because a person read a prompt and chose to press Enter. There is no CVE associated with this malware, meaning patching operating systems or applications provides no protection against the paste-and-run execution model. The only effective preventive measure is user awareness and discipline.

Remediation Implications

Microsoft's guidance for affected organizations emphasizes that victims must revoke authentication tokens rather than simply rotating passwords. Since ACR Stealer specifically targets and exfiltrates live session tokens from browsers, merely changing passwords provides insufficient protection. Attackers already possess valid authentication credentials that may remain active despite password changes. Full token revocation is necessary to completely invalidate the attacker's access to compromised accounts and services.

Sources

• https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html

• https://hackread.com/okobot-malware-clickfix-browser-extensions-crypto-data/

• https://windowsforum.com/threads/microsoft-defender-warns-clickfix-acr-stealer-steals-browser-tokens.439006

• https://gbhackers.com/acr-stealer-uses-clickfix

• https://trojan-killer.net/acr-stealer-clickfix-webdav-mshta-cleanup