ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

Security teams often fear sophisticated zero-days, but sometimes the most devastating attacks rely on simple deception. The ACR Stealer, a persistent threat active since 2024, exemplifies this by leveraging a well-known social engineering tactic known as ClickFix to plunder sensitive corporate data. By masquerading as legitimate technical support interventions, this malware manipulates users into compromising their own environments, leading to significant data breaches that fly under the radar of traditional perimeter defenses.

According to recent analysis by Microsoft’s Defender Experts team, the infostealer infiltrates networks by tricking users into believing their systems require immediate maintenance. Victims encounter fraudulent browser error pages that instruct them to resolve a supposed issue by copying a malicious command and pasting it directly into the Windows Run dialog box. Once the user executes the command, the ACR Stealer initiates a comprehensive sweep of the endpoint. It aggressively targets browser data, specifically harvesting saved passwords and live session tokens. These tokens are particularly valuable to threat actors because they allow for the bypass of multi-factor authentication (MFA) protocols, granting unauthorized access without needing the user's credentials. Beyond authentication data, the malware scrapes for intellectual property, extracting PDFs, Microsoft 365 documents, and files synced via OneDrive and SharePoint folders.

The implications of this campaign for security operations centers are multifaceted and concerning. The primary risk lies in the erosion of identity security controls; when session tokens are stolen, the effectiveness of strong passwords and MFA is rendered null. Attackers can gain immediate, trusted access to cloud environments, making detection difficult as their actions appear to originate from a legitimate user. Furthermore, the exfiltration of actual files, rather than just login credentials, suggests a shift toward direct data theft or espionage. Security teams must adapt by monitoring for anomalous process executions, specifically those spawned from the Windows Run box or command-line interfaces that are atypical for the user's role.

The persistence of ACR Stealer serves as a stark reminder that the human element remains the most vulnerable variable in the security equation. Organizations cannot rely solely on technical defenses to stop users from voluntarily executing malicious code under the guise of technical support. Defending against these threats requires robust security awareness training that specifically addresses social engineering lures involving command-line instructions. Additionally, administrators must implement stringent token monitoring and have the capability to invalidate active sessions rapidly upon detection of compromise. Ultimately, mitigating this threat involves a blend of user education, advanced endpoint detection, and rigorous cloud access governance to ensure that even if a token is stolen, its utility to an attacker is minimized.