Attack Chain

1. Initial Access via ClickFix Lure: Users are tricked by social engineering (e.g., malvertising, SEO poisoning) through a "ClickFix" prompt to execute a threat actor-provided command.
2. Remote DLL Execution via cmd.exe and rundll32.exe: The user-executed command initiates cmd.exe, which then calls rundll32.exe to load and execute a malicious DLL directly from a remote WebDAV share over HTTPS. Attackers may use pushd to map the remote share locally and conhost.exe -headless for stealth.
3. Staged PowerShell Loader Execution: The loaded DLL communicates with C2 infrastructure and executes a heavily obfuscated PowerShell script, which employs arithmetic no-ops, dead loops, and randomized variable names for evasion.
4. Payload Download and Staging: The PowerShell script downloads a ZIP-packaged payload from a remote server, extracting it into a deceptive directory (e.g., LogiOptionsPlus) under %LocalAppData%\Temp.
5. Python-based Loader Launch: A bundled pythonw.exe instance is used to launch a Python script from the extracted payload, thereby avoiding console window display.
6. Persistence Establishment: A hidden scheduled task, disguised as a legitimate software update, is created to ensure the malware's execution at user sign-in.
7. Defense Evasion: The malware copies timestamps from a legitimate Windows binary (notepad.exe) to its deployed files and clears PowerShell command history to hinder forensic analysis.
8. Information Theft and Exfiltration: The Python-based loader collects browser-stored credentials, authentication tokens, and sensitive documents, which are then prepared for exfiltration, potentially to blockchain C2 infrastructure.

Impact

Successful ACR Stealer infections lead to significant data breaches within targeted enterprises. Victims face the exposure of browser credentials, session tokens, authentication artifacts, and other sensitive documents, which can be leveraged for account compromise, unauthorized access to cloud resources, and further intrusive activities within the network. The scope of targeting is broad, impacting various enterprise customer environments observed by Microsoft Defender Experts. The theft of such critical data facilitates lateral movement and potentially expands the attacker's foothold, leading to more severe and widespread compromises.

Recommendation

• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious rundll32.exe and pythonw.exe activity.
• Enable Sysmon process creation logging to capture cmd.exe, rundll32.exe, and pythonw.exe executions for analysis.
• Monitor for rundll32.exe processes executing DLLs directly from remote network shares, especially WebDAV shares, as identified in Detect ACR Stealer Rundll32 WebDAV Payload Execution.
• Monitor for pythonw.exe processes launching from temporary user application data directories (e.g., %LocalAppData%\Temp\) when the parent process is suspicious, as described in Detect ACR Stealer Python Loader from Temp Directory.
• Implement robust endpoint detection and response (EDR) solutions, such as Microsoft Defender for Endpoint, to detect living-off-the-land binaries, obfuscated PowerShell, and scheduled task persistence.
• Educate users on "ClickFix" and other social engineering lures to prevent initial execution of malicious commands.