Loading story…
Microsoft reported a rise in ACR Stealer intrusions across customer environments, tracing two prominent infection chains that relied on ClickFix social engineering to trick users into launching malicious commands. In one chain, attackers delivered DLLs over WebDAV, then used obfuscated PowerShell, Python-based loaders, and scheduled tasks for persistence; some infections also resolved command-and-control infrastructure through blockchain-based dead-drop techniques such as EtherHiding. A second chain used mshta.exe, VBScript, and obfuscated PowerShell before retrieving payloads hidden inside a hosted JPEG and executing them filelessly in memory.
The campaigns were designed to steal browser credentials, cookies, authentication tokens, and sensitive enterprise documents, including PDFs and Microsoft 365-related files. Microsoft said the malware abuses DPAPI to decrypt browser data and stages the collected information for exfiltration. The company published indicators of compromise, MITRE ATT&CK mappings, hunting queries, and mitigation guidance focused on detecting ClickFix lures, suspicious WebDAV or MSHTA activity, obfuscated PowerShell, persistence mechanisms, and browser credential theft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft documented two prominent ACR Stealer delivery chains during the observed activity window: one using WebDAV-delivered DLLs, staged PowerShell, Python loaders, and scheduled-task persistence, and another using MSHTA, VBScript, obfuscated PowerShell, steganography, and fileless in-memory execution. In some cases, the first chain also used blockchain-based dead-drop command-and-control resolution.
Microsoft said it observed increased ACR Stealer activity across customer environments from late April 2026 to mid-June 2026. The activity involved ClickFix social engineering and credential- and document-theft objectives.
On July 16, 2026, Microsoft published analysis of the ACR Stealer campaigns along with indicators of compromise, MITRE ATT&CK mappings, hunting queries, and mitigation recommendations. The guidance focused on detecting ClickFix lures, suspicious WebDAV or MSHTA activity, obfuscated PowerShell, persistence, and browser credential theft.
On May 26, 2026, Red Canary reported that ACR Stealer had newly entered its top 10 threats because it was being delivered in ClearFake campaigns using fake CAPTCHA and paste-and-run social engineering. The report also noted delivery via fake Claude Code GitLab pages and a Go-based reflective loader that sideloaded a malicious DLL through rundll32.exe from a remote network share.
On June 13, 2025, Proofpoint reported that Amatera Stealer was a rebranded and significantly updated successor to ACR Stealer, sold as a malware-as-a-service offering and actively developed in 2025. The company also described improved evasion and command-and-control changes, including NTSockets-based HTTP communications, WoW64 syscall-based execution, and a shift toward direct hardcoded C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcetrojan-killer.net
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourceredcanary.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Researchers reported continued expansion of **ClickFix** as an initial-access technique, with attackers using fake CAPTCHA or verification pages to trick users into executing clipboard-delivered commands on Windows systems. In one campaign, **LeakNet** shifted away from relying on initial access brokers and instead used compromised legitimate websites hosting fake Cloudflare Turnstile checks to broaden victim acquisition and reduce network-based detection. ReliaQuest linked the activity to LeakNet through overlapping infrastructure and consistent TTPs, and noted the group paired ClickFix with a stealthy, memory-resident loader built on the **Deno** JavaScript runtime to support ransomware operations. A separate ClickFix campaign analyzed by Atos used the same user-executed command pattern to map attacker-controlled network drives with `net use`, then download a trojanized but legitimately signed *WorkFlowy* application whose modified `asar` archive executed malicious code in the **Node.js** main process with the logged-in user’s privileges. Other reporting on **Hive0163** also identified ClickFix as one of several initial-access methods used in **Interlock** ransomware intrusions, although that article focused primarily on the group’s likely AI-generated **Slopoly** malware rather than a specific ClickFix incident. Reporting on **Operation Covert Access** in Argentina’s judicial sector was unrelated, describing spear-phishing with fake court documents to deliver **COVERT RAT** via a different intrusion chain.
Jun 29, 2026