MicrosoftPublished
ACR Stealer: Two observed intrusion chains amid increased threat activity
By Microsoft Security Research, Balaji Venkatesh S
Excerpt
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments. Successful compromise can expose browser credentials, session tokens, authentication artifacts, and sensitive enterprise data, potentially enabling account compromise, unauthorized…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Microsoft on microsoft.com.
Mentioned in the excerpt
More from Microsoft30
- dd252791.aspxMicrosoft · Added 19 Oct
- ms14-068.aspxMicrosoft · Added 19 Oct
- assocMicrosoft · Added 18 Oct
- The Gentlemen ransomware: Dissecting a self-propagating Go encryptorMicrosoft · Published 28 May
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
