Skip to content
Threat Feed
Subscribe

Actor

ACR Stealer

1 brief RSS
high threat

ACR Stealer Campaigns Use ClickFix Lures, WebDAV, and Steganography for Credential Theft

Microsoft Defender Experts observed increased ACR Stealer activity from late April to mid-June 2026, using ClickFix social engineering lures in two distinct campaigns to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments via WebDAV-based Python loaders or MSHTA-initiated PowerShell with steganography.

Windows ACR Stealer infostealer malware-as-a-service social-engineering webdav powershell steganography credential-theft data-exfiltration
2r 18t