ACR Stealer Is Raiding Enterprise Networks and All It Needs Is for Someone to Press Enter
A piece of credential-theft malware called ACR Stealer has been quietly emptying enterprise networks of browser passwords, live session tokens, PDFs, and Microsoft 365 documents since 2024. It also hoovers up anything sitting in synced OneDrive and SharePoint folders. No vulnerability required. The only thing it needs is a logged-in user who reads a fake prompt and pastes a command into a Run box.
Microsoft's Defender Experts team published a breakdown of two distinct delivery chains after watching ACR Stealer activity rise steadily across customer environments between late April and mid-June this year. Both chains start with the same ClickFix-style lure. After that they diverge, one leaving traces on disk, one running almost entirely in memory.
The token-revocation detail in Microsoft's remediation guidance is worth noting: the advice isn't just to change passwords. It's to revoke tokens. That's because by the time this thing is done, rotating a password doesn't undo the damage.
A JPEG Full of Malware
The fileless chain is the more technically involved of the two. The pasted command fires up mshta.exe, which fetches remote HTA content. Embedded VBScript uses COM objects to decode and run PowerShell in memory. That stage generates a victim ID, kills certificate validation, and retrieves its next payload.
What it retrieves is a JPEG hosted on an image service. The actual payload is hidden in the pixel data. Custom routines extract it, decrypt it, decompress it, and execute it without it ever touching disk in any obvious form. Then it goes after Chrome and Edge: reading their Login Data and Web Data SQLite databases and calling on DPAPI to decrypt whatever credentials, cookies, and session tokens are stored there. Desktop and Downloads PDFs leave too.
On 26 May, SANS Internet Storm Center handler Brad Duncan wrote up a Windows infection he'd traced to a page impersonating Anthropic's Claude AI assistant, reached through malicious Google ads and often served behind sites.google.com URLs. The page was smart enough to serve different instructions depending on whether the visitor was on macOS or Windows. Microsoft's report doesn't name the lure directly, but two of the campaign indicators in its own tables match domains from Duncan's chain documented seven weeks earlier, and the report cites his writeup in its references.
Duncan had also flagged a 628KB JPEG pulled from ImgBB during the infection, noting he couldn't find obvious signs of embedded data. In light of Microsoft's analysis, that image deserves a second look.
Red Canary had spotted Claude-branded lures even earlier, about a month before Duncan's writeup, delivering ACR Stealer through fake Claude Code pages hosted on GitLab subdomains.
The Chain That Leaves Footprints
The disk-based chain is noisier, which is a gift for defenders. The pasted command pulls a DLL directly from a WebDAV share over HTTPS, using a GUID-structured directory path and a filename designed to look benign. Microsoft's example uses google.ct as the filename. Red Canary had already published the same infection shape in May, from April telemetry.
Two of the three variants Microsoft observed use pushd to mount the remote share as a temporary local drive, so execution looks like it's coming from a local path rather than a remote one. The stealthiest version wraps the whole thing inside conhost.exe --headless to suppress any console window, and uses delayed environment-variable expansion to obscure the strings for pushd, rundll32, and the remote host.
Obfuscated PowerShell then drops a ZIP archive into a folder under %LocalAppData%\Temp with an innocuous-sounding name. A bundled pythonw.exe runs the Python script silently. The installer removes older copies before placing new ones, which effectively makes it a self-updating implant.
Persistence comes through a hidden scheduled task dressed up as a software update. The malware copies timestamps from notepad.exe onto its own files to blend into the filesystem and clears PowerShell history on the way out. Final execution happens through the Windows Fiber API, keeping the last stage in memory.
In a subset of infections, a second Python loader was seen talking to public blockchain RPC endpoints. Microsoft identifies this as EtherHiding: the attacker buries a payload address or C2 pointer inside a smart contract on a public ledger. There's no attacker-controlled resolver to seize or sinkhole. It's not a new technique, but it's effective precisely because the infrastructure isn't the attacker's to lose.
No CVE, No Victim Count
Neither chain exploits a software vulnerability. Both run with whatever permissions the signed-in user already has. Every subsequent layer, the WebDAV mount, the pixel extraction, the fiber-based handoff, only executes because a human being read a fake prompt and did what it said. Patching doesn't fix this.
Microsoft says the lures are working but offers no numbers to back that up. No victim count, no affected customer figures, no baseline for the increase it references. Red Canary's April data is more concrete: ClearFake, a web-inject cluster that has been feeding ACR Stealer payloads since at least March 2025, topped Red Canary's most-prevalent-threat list for the first time that month. ACR Stealer itself entered the top ten, tied for sixth. ClearFake delivers through JavaScript injected into compromised websites. Microsoft's report doesn't mention it in either of its documented chains.
Who Owns This Thing Now
Microsoft ties the activity to ACR Stealer based on observed behavior and post-exploitation tradecraft matched against what's publicly documented about the family. It names no threat actor. Given the ownership history, that caution makes sense.
ACR Stealer, also written up as AcridRain, was originally sold on Russian-speaking forums by an operator known as SheldIO, who announced the end of sales in July 2024. What happened after that depends on who you ask. eSentire says the source code was sold. Proofpoint's account is different: the shutdown announcement came from the Telegram channel itself, not from the team, and a panel called Amatera appeared five months later. Both agree on the rebrand. Proofpoint reported in June 2025 that ACR Stealer had been substantially updated and relaunched as Amatera Stealer, with pricing running from $199 a month to $1,499 a year. Red Canary treats ACR and Amatera as one continuous family and traces ACR itself back to something called GrMsk Stealer.
A detection label applied to activity in 2025 describes the code's behavior. It doesn't tell you who's operating the infrastructure this week.
Where to Actually Stop It
Every technique documented here fails if the user doesn't paste the command. That's the only choke point that sits above all of them.
The practical controls follow from that. Removing the Run dialog via Group Policy cuts the entry point entirely. Blocking mshta.exe through AppLocker or WDAC removes one of the primary execution paths. Application control and attack surface reduction rules should prevent PowerShell, Python, mshta.exe, and rundll32.exe from executing content fetched from Downloads, Temp, or %LocalAppData%.
For hunting, Red Canary flags rundll32.exe making network connections with no command-line arguments as a detection opportunity specific to this family. Scheduled tasks impersonating software updates, timestomping activity, and PowerShell history deletion are all worth querying.
On a suspected compromise: isolate the host, rotate credentials, revoke tokens, and check outbound connections to WebDAV shares and image-hosting services.
Microsoft released three Defender XDR hunting queries and 16 campaign-associated domains with its report. The indicators are described as representative, not exhaustive, with more campaigns and infrastructure presumed active. Domains rotate. The fake prompt asking someone to paste a command does not, because it keeps working.