ACR Stealer Targets Enterprises with ClickFix and MSHTA Lures

The content discusses the rise of ACR Stealer, a malware family designed to steal browser credentials and other sensitive data. Notably, Microsoft reported an increase in ACR Stealer activity targeting enterprise Windows environments between late April and mid-June 2026. Attackers use ClickFix lures delivered via malvertising or toxic search results to initiate infections. Two primary infection methods are detailed: one involves a remote DLL download while the other employs a fileless approach via MSHTA.

Both methods aim to extract confidential information, with a focus on browser data and Microsoft 365 files, leveraging Windows DPAPI to access stored secrets. The article emphasizes the need for user training to avoid pasting commands from dubious sources and recommends immediate revocation of compromised tokens to enhance security against such threats.