ACR Stealer: Two observed intrusion chains amid increased threat activity

1. Executive summary

From late April to mid-June 2026, Microsoft Defender Experts observed two prevalent intrusion chains delivering ACR Stealer, an information-stealing malware-as-a-service (MaaS) family reportedly linked to the rebranding of Amatera Stealer. Both chains use ClickFix social-engineering lures (malvertising/SEO poisoning) to trick users into executing commands, ultimately harvesting browser credentials, session tokens, and sensitive enterprise documents. Campaign 1 relies on WebDAV-delivered DLLs, Python-based loaders, and blockchain-backed dead-drop C2 resolution; Campaign 2 uses a fileless MSHTA/VBScript chain with steganography-assisted in-memory execution. Attribution to "ACR Stealer" is unconfirmed — the actor has no MITRE ATT&CK profile; attribution rests solely on Microsoft's behavioural analysis and OSINT infrastructure correlation (single-sourced; verify before enforcement). EMEA financial services face direct risk of SSO/MFA bypass via stolen session cookies, enabling unauthorised access to cloud resources and follow-on intrusion activity.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: "ACR Stealer" has no MITRE ATT&CK profile. Attribution is based on Microsoft's observed behaviour and OSINT infrastructure correlation only. Treat as unconfirmed.

Campaign 1: WebDAV-based ClickFix with Python loaders and blockchain C2

1. Initial access (ClickFix lure): User encounters a ClickFix prompt via malvertising or SEO-manipulated search results. The prompt instructs the user to run a command launching cmd.exe.
2. Execution via WebDAV: The command invokes rundll32.exe to load a DLL from a remote WebDAV share over HTTPS. The WebDAV path uses a GUID-based directory structure with filenames resembling legitimate resources (e.g., google.ct). Three variants observed: - Variant 1: Direct rundll32 invocation. - Variant 2: pushd mounts the remote WebDAV share to a temporary local drive; execution follows via local path. - Variant 3: Headless and obfuscated pushd execution — uses conhost.exe --headless to suppress console windows and environment variable obfuscation with delayed variable expansion to conceal pushd, rundll32, and the remote hostname.
3. PowerShell staging: Once rundll32.exe loads the DLL, the malware executes a heavily obfuscated PowerShell script (arithmetic no-ops, dead loops, fake control flow, randomized variable names).
4. Python loader & persistence: The PowerShell script deploys a Python-based stage functioning as both installer and persistence mechanism. The Python loader is heavily obfuscated: dynamic API resolution, encoded string reconstruction, junk-data removal, character shifting, string reversal, Base64 decoding, and zlib decompression. The payload is unreadable statically and reconstructed only at runtime. Persistence is established via a scheduled task masquerading as a software update (task name contains Autoupdate and an 8-digit date string).
5. In-memory shellcode execution: The final-stage payload extracts an archive masquerading as a legitimate application installer, reads a file from it, and injects shellcode into a system process. Memory allocation via VirtualAlloc; execution transfer via Windows Fiber API (ConvertThreadToFiber, CreateFiber, SwitchToFiber). Minimal disk artifacts.
6. Credential & data harvesting: The injected code invokes Windows DPAPI routines to decrypt browser-stored passwords, cookies, and authentication tokens. Enumerates PDFs, Microsoft 365 documents, and enterprise-synced directories (OneDrive, SharePoint). Collected data is archived for exfiltration.
7. C2 — blockchain dead-drop resolver (subset of intrusions): A secondary Python loader queries public blockchain RPC endpoints and third-party Web3 node infrastructure to retrieve follow-on payloads or C2 addresses (EtherHiding technique). Operators can dynamically update infrastructure without redeploying malware.

Campaign 2: Fileless MSHTA with steganography-assisted execution

1. Initial access (ClickFix lure): Same ClickFix social engineering via malvertising/SEO. The prompt triggers a command spawning mshta.exe to fetch and execute remote HTA content from an actor-controlled domain.
2. VBScript loader: Embedded VBScript in the HTA abuses COM objects to decode and execute encoded PowerShell content.
3. Obfuscated PowerShell: Same obfuscation techniques as Campaign 1 (randomized variable names, arithmetic no-ops, dead loops, misleading control flow, custom encryption routines). Generates a victim-specific identifier and disables certificate validation before contacting next-stage infrastructure.
4. Steganographic payload retrieval: Instead of downloading a secondary script, the malware retrieves a JPEG image from an image-hosting service. Custom routines extract an embedded payload from image pixels, decrypt and decompress it, and execute it entirely in memory.
5. Reflective shellcode execution: Dynamically resolves LoadLibrary, GetProcAddress, VirtualAlloc, CreateThread, and WaitForSingleObject at runtime for reflective shellcode execution. No on-disk artifacts.
6. Credential & data harvesting: Accesses Chromium-based browser credential stores (Google Chrome, Microsoft Edge) — specifically the Login Data and Web Data databases — alongside DPAPI decryption activity. Enumerates and accesses PDF documents across Desktop and Downloads locations. Data staged for exfiltration.

4. Mitigation & containment

P1 — within 24 hours

• Block the C2 and payload-hosting domains listed in §5 at DNS resolver, web proxy, and firewall egress layers.
• Hunt for scheduled tasks matching the persistence pattern: task name containing Autoupdate and an 8-digit date string, created by powershell.exe. Remove any matches.
• Search endpoint telemetry for rundll32.exe loading DLLs from @ssl WebDAV paths with GUID directory structures, and for mshta.exe launched from explorer.exe fetching remote HTA content over HTTPS.
• Review authentication logs for anomalous session usage (impossible travel, new device registrations, unexpected cloud resource access) consistent with stolen session token replay.

P2 — within 72 hours

• Deploy or tune EDR detection rules for: conhost.exe --headless spawning from cmd.exe; pushd mapping WebDAV shares followed by rundll32 execution; pythonw.exe executing from unusual directories; DPAPI access by non-browser processes; VirtualAlloc + Fiber API calls in non-standard processes.
• Restrict WebDAV access at the network perimeter where not business-required; block outbound HTTPS to uncategorised domains serving WebDAV content.
• Enforce conditional access policies requiring device compliance for SSO/cloud access — stolen session tokens are less useful when the authenticating device is not enrolled/compliant.
• Review browser extension and credential store access policies; consider disabling credential saving in managed Chromium-based browsers for high-risk roles.

P3 — within 7 days

• Deliver targeted user awareness on ClickFix lures (fake CAPTCHA/verification prompts instructing users to run commands).
• Validate that EDR behavioural coverage flags: LOLBin execution (rundll32, mshta), obfuscated PowerShell, scheduled-task persistence, in-memory payload execution, and browser credential theft patterns.
• Assess whether blockchain RPC endpoint egress is necessary in the environment; if not, block at firewall to disrupt EtherHiding C2 resolution.

5. Indicators of compromise

domain  looksta[.]icu
domain  contrite.quirksturdy[.]icu
domain  ux.strainedeasily[.]icu
domain  cpppemwjewjoiwejow[.]sale
domain  breaksd.wifihot[.]icu
domain  walter.filloco[.]icu
domain  fast.raidher[.]icu
domain  apigrokcloud[.]icu
domain  enhanceblabber[.]cc
domain  deep-harborio[.]com
domain  auramatrixa[.]com
domain  zealpraxis[.]com
domain  prism-vertex[.]com
domain  prism-matrixs[.]com
domain  proton-network[.]com
domain  creativecommunityinfo[.]art

Behavioural indicators

6. Detection

rule ACR_Stealer_Campaign1_Python_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-17"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/"
    description = "Detects ACR Stealer Campaign 1 Python loader artefacts and Fiber API shellcode injection"
  strings:
    $fiber1 = "ConvertThreadToFiber" ascii
    $fiber2 = "CreateFiber" ascii
    $fiber3 = "SwitchToFiber" ascii
    $virtualalloc = "VirtualAlloc" ascii
    $webdav_guid = /\\\\[^\\]+@ssl\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\w+\.\w+,#1/ ascii
    $google_ct = "google.ct" ascii
    $autoupdate = "Autoupdate" ascii
    $pushd = "pushd" ascii
    $conhost_headless = "conhost --headless" ascii
  condition:
    3 of them
}

rule ACR_Stealer_Campaign2_Steganography_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-17"
    reference = "https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/"
    description = "Detects ACR Stealer Campaign 2 reflective shellcode loader API resolution and steganography chain"
  strings:
    $loadlibrary = "LoadLibrary" ascii
    $getprocaddress = "GetProcAddress" ascii
    $virtualalloc = "VirtualAlloc" ascii
    $createthread = "CreateThread" ascii
    $waitforsingleobject = "WaitForSingleObject" ascii
    $login_data = "Login Data" ascii
    $web_data = "Web Data" ascii
  condition:
    4 of them
}

title: ACR Stealer ClickFix WebDAV Execution via Rundll32
id: 7a3c1f2e-4b5d-4a8e-9c1f-2d3e4f5a6b7c
status: experimental
description: Detects rundll32 loading a DLL from a remote WebDAV share over HTTPS with GUID-based directory structure, consistent with ACR Stealer Campaign 1 ClickFix delivery
author: Adverse Trace
date: 2026/07/17
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/
logsource:
  product: windows
  category: process_creation
detection:
  selection_rundll32_webdav:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:

      - '@ssl'
    CommandLine|re: '\\\\[^\\]+@ssl\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\w+\.\w+,#1'
  selection_pushd_webdav:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:

      - 'pushd'
      - '@ssl'
    CommandLine|re: 'pushd \\\\[^\\]+@ssl\\[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
  selection_conhost_headless:
    Image|endswith: '\conhost.exe'
    CommandLine|contains|all:

      - '--headless'
      - '@ssl'
      - 'rundll32'
  condition: selection_rundll32_webdav or selection_pushd_webdav or selection_conhost_headless
level: high

title: ACR Stealer MSHTA Execution from Explorer via ClickFix
id: 8b4d2g3f-5c6e-4b9f-0d2g-3e4f5a6b7c8d
status: experimental
description: Detects mshta.exe launched from explorer.exe fetching remote HTA content over HTTPS, consistent with ACR Stealer Campaign 2
author: Adverse Trace
date: 2026/07/17
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:

      - 'mshta.exe'
      - 'https://'
    CommandLine|re: '/[0-9]{7}'
  condition: selection
level: high

title: ACR Stealer Scheduled Task Persistence Masquerading as Software Update
id: 9c5e3h4g-6d7f-4c0a-1e3h-4f5a6b7c8d9e
status: experimental
description: Detects scheduled task creation by PowerShell with Autoupdate name and 8-digit date, consistent with ACR Stealer persistence
author: Adverse Trace
date: 2026/07/17
references:

  - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains|all:

      - 'schtasks'
      - '/run /tn'
      - 'Autoupdate'
    CommandLine|re: '[0-9]{8}'
  condition: selection
level: high

7. Sources

• Microsoft Security Blog, "ACR Stealer: Two observed intrusion chains amid increased threat activity," https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/, 2026-07-16
• Microsoft Security Blog, "StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them," https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/, 2026-06-24

8. Adverse Trace position

This is a high-severity threat for EMEA financial services. ACR Stealer's two observed campaigns demonstrate mature, evasive tradecraft — WebDAV-based LOLBin execution, Python-layer obfuscation, Fiber API shellcode injection, steganographic payload delivery, and blockchain-backed C2 resolution — all aimed at harvesting browser credentials and session tokens that can bypass MFA and enable unauthorised cloud access. The ClickFix initial-access vector remains effective because it exploits user behaviour rather than technical vulnerabilities, making perimeter controls insufficient on their own. Attribution to "ACR Stealer" is unconfirmed (no MITRE profile; single-sourced to Microsoft behavioural analysis) — clients should enforce on the observed behaviours and IOCs rather than the actor name. We are treating the IOC set as representative, not exhaustive — additional campaigns and infrastructure are likely active. Next steps: we will monitor for infrastructure churn (particularly new .icu and .com domains matching the naming patterns in §5), track for any confirmed follow-on intrusion activity leveraging stolen credentials from these campaigns, and assess whether the blockchain dead-drop resolver technique spreads to other MaaS families.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.