ACR Stealer Exploits ClickFix Social Engineering to Harvest Enterprise Credentials

The ACR Stealer campaigns observed between late April and mid-June 2026 succeeded primarily because users were manipulated through ClickFix social engineering tactics into executing malicious payloads delivered via WebDAV and MSHTA. This highlights how technically sophisticated delivery chains — including blockchain-backed C2, steganography, and obfuscated PowerShell — become highly effective when paired with human deception. The theft of browser credentials and authentication tokens can grant attackers persistent, privileged access to enterprise systems far beyond the initial compromise. Organizations that lack behavioral detection controls and user awareness programs are especially vulnerable to these multi-stage, living-off-the-land style attacks.

Tactical Insight

Immediate actions

Block or restrict WebDAV access at the perimeter firewall and enforce application allowlisting to prevent unauthorized Python loader execution.
Disable or heavily restrict MSHTA and PowerShell execution for non-administrative users via Group Policy or endpoint management tools.
Enforce multi-factor authentication (MFA) on all accounts to reduce the impact of stolen browser credentials and authentication tokens.

Security awareness measures

Train employees to recognize ClickFix and other social engineering lures, emphasizing skepticism toward unsolicited browser prompts or copy-paste instruction pages.
Run simulated social engineering exercises targeting ClickFix-style scenarios to measure and improve user resilience.

Detection and monitoring improvements

Deploy behavioral detection rules in your EDR/SIEM to flag obfuscated PowerShell execution, unexpected MSHTA invocations, and anomalous WebDAV connections.
Monitor for outbound connections to blockchain-based or unconventional C2 infrastructure using DNS and network traffic analysis.
Implement credential monitoring solutions to detect when harvested tokens or browser-stored passwords appear in threat intelligence feeds.

Framework References

CIS Control 2: Inventory and Control of Software AssetsCIS Control 4: Secure Configuration of Enterprise AssetsCIS Control 9: Email and Web Browser ProtectionsCIS Control 14: Security Awareness and Skills TrainingCIS Control 13: Network Monitoring and DefenseNIST SP 800-53 AC-2: Account ManagementNIST SP 800-53 AC-17: Remote AccessNIST SP 800-53 IA-5: Authenticator ManagementNIST SP 800-53 SI-3: Malicious Code ProtectionNIST SP 800-53 AU-12: Audit Record GenerationNIST SP 800-53 AT-2: Literacy Training and AwarenessMITRE ATT&CK T1204: User ExecutionMITRE ATT&CK T1059.001: PowerShellMITRE ATT&CK T1555.003: Credentials from Web BrowsersGDPR Article 32: Security of Processing

Source

ThreatNoir coverageACR Stealer: Two observed intrusion chains amid increased threat activity Read originalACR Stealer: Two observed intrusion chains amid increased threat activity

PublishedJul 17, 2026