> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ACR Stealer: Two observed intrusion chains amid increased threat activity - URL: https://f4n6.co.uk/security-feed/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ - Published: 2026-07-17T08:58:31.000Z - Updated: 2026-07-17T08:58:31.000Z - Author: Jeff Davies - Tags: #security-feed, ACR Stealer ## 1\. Executive summary From late April to mid-June 2026, Microsoft Defender Experts observed two prevalent intrusion chains delivering ACR Stealer, an information-stealing malware-as-a-service (MaaS) family reportedly linked to the rebranding of Amatera Stealer. Both chains use ClickFix social-engineering lures (malvertising/SEO poisoning) to trick users into executing commands, ultimately harvesting browser credentials, session tokens, and sensitive enterprise documents. Campaign 1 relies on WebDAV-delivered DLLs, Python-based loaders, and blockchain-backed dead-drop C2 resolution; Campaign 2 uses a fileless MSHTA/VBScript chain with steganography-assisted in-memory execution. Attribution to "ACR Stealer" is unconfirmed — the actor has no MITRE ATT&CK profile; attribution rests solely on Microsoft's behavioural analysis and OSINT infrastructure correlation (single-sourced; verify before enforcement). EMEA financial services face direct risk of SSO/MFA bypass via stolen session cookies, enabling unauthorised access to cloud resources and follow-on intrusion activity. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | Stolen session tokens and browser credentials enable account compromise and unauthorised cloud access — a credential-theft incident whose impact classification depends on the data sensitivity and affected business functions. | Classify any confirmed ACR Stealer infection by data sensitivity (credentials, tokens, enterprise documents) and potential business impact to determine whether major-incident reporting under Art. 19 is triggered. | | DORA Art. 24: digital operational resilience testing — general requirements | ClickFix lures bypass perimeter controls via social engineering; detection depends on behavioural monitoring of LOLBins, WebDAV, and credential-store access. | Validate EDR and SIEM detection coverage against the specific behaviours in §3/§6 (WebDAV+rundll32, MSHTA from explorer, DPAPI access by non-browser processes) as part of resilience testing. | ## 3\. Technical analysis & attack chain **Attribution caveat:** "ACR Stealer" has no MITRE ATT&CK profile. Attribution is based on Microsoft's observed behaviour and OSINT infrastructure correlation only. Treat as unconfirmed. ### Campaign 1: WebDAV-based ClickFix with Python loaders and blockchain C2 1. **Initial access (ClickFix lure):** User encounters a ClickFix prompt via malvertising or SEO-manipulated search results. The prompt instructs the user to run a command launching `cmd.exe`. 2. **Execution via WebDAV:** The command invokes `rundll32.exe` to load a DLL from a remote WebDAV share over HTTPS. The WebDAV path uses a GUID-based directory structure with filenames resembling legitimate resources (e.g., `google.ct`). Three variants observed: - **Variant 1:** Direct `rundll32` invocation. - **Variant 2:** `pushd` mounts the remote WebDAV share to a temporary local drive; execution follows via local path. - **Variant 3:** Headless and obfuscated `pushd` execution — uses `conhost.exe --headless` to suppress console windows and environment variable obfuscation with delayed variable expansion to conceal `pushd`, `rundll32`, and the remote hostname. 3. **PowerShell staging:** Once `rundll32.exe` loads the DLL, the malware executes a heavily obfuscated PowerShell script (arithmetic no-ops, dead loops, fake control flow, randomized variable names). 4. **Python loader & persistence:** The PowerShell script deploys a Python-based stage functioning as both installer and persistence mechanism. The Python loader is heavily obfuscated: dynamic API resolution, encoded string reconstruction, junk-data removal, character shifting, string reversal, Base64 decoding, and zlib decompression. The payload is unreadable statically and reconstructed only at runtime. Persistence is established via a scheduled task masquerading as a software update (task name contains `Autoupdate` and an 8-digit date string). 5. **In-memory shellcode execution:** The final-stage payload extracts an archive masquerading as a legitimate application installer, reads a file from it, and injects shellcode into a system process. Memory allocation via `VirtualAlloc`; execution transfer via Windows Fiber API (`ConvertThreadToFiber`, `CreateFiber`, `SwitchToFiber`). Minimal disk artifacts. 6. **Credential & data harvesting:** The injected code invokes Windows DPAPI routines to decrypt browser-stored passwords, cookies, and authentication tokens. Enumerates PDFs, Microsoft 365 documents, and enterprise-synced directories (OneDrive, SharePoint). Collected data is archived for exfiltration. 7. **C2 — blockchain dead-drop resolver (subset of intrusions):** A secondary Python loader queries public blockchain RPC endpoints and third-party Web3 node infrastructure to retrieve follow-on payloads or C2 addresses (EtherHiding technique). Operators can dynamically update infrastructure without redeploying malware. ### Campaign 2: Fileless MSHTA with steganography-assisted execution 1. **Initial access (ClickFix lure):** Same ClickFix social engineering via malvertising/SEO. The prompt triggers a command spawning `mshta.exe` to fetch and execute remote HTA content from an actor-controlled domain. 2. **VBScript loader:** Embedded VBScript in the HTA abuses COM objects to decode and execute encoded PowerShell content. 3. **Obfuscated PowerShell:** Same obfuscation techniques as Campaign 1 (randomized variable names, arithmetic no-ops, dead loops, misleading control flow, custom encryption routines). Generates a victim-specific identifier and disables certificate validation before contacting next-stage infrastructure. 4. **Steganographic payload retrieval:** Instead of downloading a secondary script, the malware retrieves a JPEG image from an image-hosting service. Custom routines extract an embedded payload from image pixels, decrypt and decompress it, and execute it entirely in memory. 5. **Reflective shellcode execution:** Dynamically resolves `LoadLibrary`, `GetProcAddress`, `VirtualAlloc`, `CreateThread`, and `WaitForSingleObject` at runtime for reflective shellcode execution. No on-disk artifacts. 6. **Credential & data harvesting:** Accesses Chromium-based browser credential stores (Google Chrome, Microsoft Edge) — specifically the `Login Data` and `Web Data` databases — alongside DPAPI decryption activity. Enumerates and accesses PDF documents across Desktop and Downloads locations. Data staged for exfiltration. ## 4\. Mitigation & containment ### P1 — within 24 hours - Block the C2 and payload-hosting domains listed in §5 at DNS resolver, web proxy, and firewall egress layers. - Hunt for scheduled tasks matching the persistence pattern: task name containing `Autoupdate` and an 8-digit date string, created by `powershell.exe`. Remove any matches. - Search endpoint telemetry for `rundll32.exe` loading DLLs from `@ssl` WebDAV paths with GUID directory structures, and for `mshta.exe` launched from `explorer.exe` fetching remote HTA content over HTTPS. - Review authentication logs for anomalous session usage (impossible travel, new device registrations, unexpected cloud resource access) consistent with stolen session token replay. ### P2 — within 72 hours - Deploy or tune EDR detection rules for: `conhost.exe --headless` spawning from `cmd.exe`; `pushd` mapping WebDAV shares followed by `rundll32` execution; `pythonw.exe` executing from unusual directories; DPAPI access by non-browser processes; `VirtualAlloc` \+ Fiber API calls in non-standard processes. - Restrict WebDAV access at the network perimeter where not business-required; block outbound HTTPS to uncategorised domains serving WebDAV content. - Enforce conditional access policies requiring device compliance for SSO/cloud access — stolen session tokens are less useful when the authenticating device is not enrolled/compliant. - Review browser extension and credential store access policies; consider disabling credential saving in managed Chromium-based browsers for high-risk roles. ### P3 — within 7 days - Deliver targeted user awareness on ClickFix lures (fake CAPTCHA/verification prompts instructing users to run commands). - Validate that EDR behavioural coverage flags: LOLBin execution (rundll32, mshta), obfuscated PowerShell, scheduled-task persistence, in-memory payload execution, and browser credential theft patterns. - Assess whether blockchain RPC endpoint egress is necessary in the environment; if not, block at firewall to disrupt EtherHiding C2 resolution. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------ | ----------------------------- | ---------- | ----------------------- | | domain | looksta\[.\]icu | Medium | Microsoft Security Blog | | domain | contrite.quirksturdy\[.\]icu | Medium | Microsoft Security Blog | | domain | ux.strainedeasily\[.\]icu | Medium | Microsoft Security Blog | | domain | cpppemwjewjoiwejow\[.\]sale | Medium | Microsoft Security Blog | | domain | breaksd.wifihot\[.\]icu | Medium | Microsoft Security Blog | | domain | walter.filloco\[.\]icu | Medium | Microsoft Security Blog | | domain | fast.raidher\[.\]icu | Medium | Microsoft Security Blog | | domain | apigrokcloud\[.\]icu | Medium | Microsoft Security Blog | | domain | enhanceblabber\[.\]cc | Medium | Microsoft Security Blog | | domain | deep-harborio\[.\]com | Medium | Microsoft Security Blog | | domain | auramatrixa\[.\]com | Medium | Microsoft Security Blog | | domain | zealpraxis\[.\]com | Medium | Microsoft Security Blog | | domain | prism-vertex\[.\]com | Medium | Microsoft Security Blog | | domain | prism-matrixs\[.\]com | Medium | Microsoft Security Blog | | domain | proton-network\[.\]com | Medium | Microsoft Security Blog | | domain | creativecommunityinfo\[.\]art | Medium | Microsoft Security Blog | ```iocs domain looksta[.]icu domain contrite.quirksturdy[.]icu domain ux.strainedeasily[.]icu domain cpppemwjewjoiwejow[.]sale domain breaksd.wifihot[.]icu domain walter.filloco[.]icu domain fast.raidher[.]icu domain apigrokcloud[.]icu domain enhanceblabber[.]cc domain deep-harborio[.]com domain auramatrixa[.]com domain zealpraxis[.]com domain prism-vertex[.]com domain prism-matrixs[.]com domain proton-network[.]com domain creativecommunityinfo[.]art ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- | ---------- | | rundll32.exe loading DLL from WebDAV path (@ssl, GUID directory, e.g. google.ct) | EDR process telemetry, proxy logs | High | | pushd mapping remote WebDAV share to temporary drive letter, followed by rundll32 execution | EDR process command-line telemetry | High | | conhost.exe --headless with delayed variable expansion obfuscating pushd/rundll32/hostname | EDR process command-line telemetry | High | | mshta.exe launched from explorer.exe fetching remote HTA content over HTTPS | EDR process telemetry | High | | Scheduled task created by powershell.exe with name containing Autoupdate and 8-digit date | EDR scheduled-task creation events, Windows Event Log | High | | pythonw.exe executing from non-standard directory with obfuscated loader | EDR process telemetry | Medium | | DPAPI calls (CryptUnprotectData) from non-browser processes accessing Login Data / Web Data SQLite databases | EDR file/API access telemetry | High | | Outbound connections to public blockchain RPC endpoints / Web3 node infrastructure from Python processes | Network firewall, proxy logs | Medium | | JPEG image fetched from image-hosting service followed by in-memory payload execution | EDR network telemetry, proxy logs | Medium | ## 6\. Detection ```yara rule ACR_Stealer_Campaign1_Python_Loader { meta: author = "Adverse Trace" date = "2026-07-17" reference = "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/" description = "Detects ACR Stealer Campaign 1 Python loader artefacts and Fiber API shellcode injection" strings: $fiber1 = "ConvertThreadToFiber" ascii $fiber2 = "CreateFiber" ascii $fiber3 = "SwitchToFiber" ascii $virtualalloc = "VirtualAlloc" ascii $webdav_guid = /\\\\[^\\]+@ssl\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\w+\.\w+,#1/ ascii $google_ct = "google.ct" ascii $autoupdate = "Autoupdate" ascii $pushd = "pushd" ascii $conhost_headless = "conhost --headless" ascii condition: 3 of them } rule ACR_Stealer_Campaign2_Steganography_Loader { meta: author = "Adverse Trace" date = "2026-07-17" reference = "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/" description = "Detects ACR Stealer Campaign 2 reflective shellcode loader API resolution and steganography chain" strings: $loadlibrary = "LoadLibrary" ascii $getprocaddress = "GetProcAddress" ascii $virtualalloc = "VirtualAlloc" ascii $createthread = "CreateThread" ascii $waitforsingleobject = "WaitForSingleObject" ascii $login_data = "Login Data" ascii $web_data = "Web Data" ascii condition: 4 of them } ``` ```yaml title: ACR Stealer ClickFix WebDAV Execution via Rundll32 id: 7a3c1f2e-4b5d-4a8e-9c1f-2d3e4f5a6b7c status: experimental description: Detects rundll32 loading a DLL from a remote WebDAV share over HTTPS with GUID-based directory structure, consistent with ACR Stealer Campaign 1 ClickFix delivery author: Adverse Trace date: 2026/07/17 references: - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ logsource: product: windows category: process_creation detection: selection_rundll32_webdav: Image|endswith: '\rundll32.exe' CommandLine|contains|all: - '@ssl' CommandLine|re: '\\\\[^\\]+@ssl\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\w+\.\w+,#1' selection_pushd_webdav: Image|endswith: '\cmd.exe' CommandLine|contains|all: - 'pushd' - '@ssl' CommandLine|re: 'pushd \\\\[^\\]+@ssl\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' selection_conhost_headless: Image|endswith: '\conhost.exe' CommandLine|contains|all: - '--headless' - '@ssl' - 'rundll32' condition: selection_rundll32_webdav or selection_pushd_webdav or selection_conhost_headless level: high ``` ```yaml title: ACR Stealer MSHTA Execution from Explorer via ClickFix id: 8b4d2g3f-5c6e-4b9f-0d2g-3e4f5a6b7c8d status: experimental description: Detects mshta.exe launched from explorer.exe fetching remote HTA content over HTTPS, consistent with ACR Stealer Campaign 2 author: Adverse Trace date: 2026/07/17 references: - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: '\explorer.exe' Image|endswith: '\powershell.exe' CommandLine|contains|all: - 'mshta.exe' - 'https://' CommandLine|re: '/[0-9]{7}' condition: selection level: high ``` ```yaml title: ACR Stealer Scheduled Task Persistence Masquerading as Software Update id: 9c5e3h4g-6d7f-4c0a-1e3h-4f5a6b7c8d9e status: experimental description: Detects scheduled task creation by PowerShell with Autoupdate name and 8-digit date, consistent with ACR Stealer persistence author: Adverse Trace date: 2026/07/17 references: - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ logsource: product: windows category: process_creation detection: selection: Image|endswith: '\powershell.exe' CommandLine|contains|all: - 'schtasks' - '/run /tn' - 'Autoupdate' CommandLine|re: '[0-9]{8}' condition: selection level: high ``` ## 7\. Sources - Microsoft Security Blog, "ACR Stealer: Two observed intrusion chains amid increased threat activity," https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/, 2026-07-16 - Microsoft Security Blog, "StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them," https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/, 2026-06-24 ## 8\. Adverse Trace position This is a **high-severity** threat for EMEA financial services. ACR Stealer's two observed campaigns demonstrate mature, evasive tradecraft — WebDAV-based LOLBin execution, Python-layer obfuscation, Fiber API shellcode injection, steganographic payload delivery, and blockchain-backed C2 resolution — all aimed at harvesting browser credentials and session tokens that can bypass MFA and enable unauthorised cloud access. The ClickFix initial-access vector remains effective because it exploits user behaviour rather than technical vulnerabilities, making perimeter controls insufficient on their own. Attribution to "ACR Stealer" is unconfirmed (no MITRE profile; single-sourced to Microsoft behavioural analysis) — clients should enforce on the observed behaviours and IOCs rather than the actor name. We are treating the IOC set as representative, not exhaustive — additional campaigns and infrastructure are likely active. Next steps: we will monitor for infrastructure churn (particularly new `.icu` and `.com` domains matching the naming patterns in §5), track for any confirmed follow-on intrusion activity leveraging stolen credentials from these campaigns, and assess whether the blockchain dead-drop resolver technique spreads to other MaaS families. --- [Read the original source →](https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*