Microsoft Reports Surge in ACR Stealer Attacks Using ClickFix, WebDAV and MSHTA
Summary
Microsoft reports a surge in ACR Stealer attacks targeting enterprise customers. The campaigns use ClickFix, WebDAV and MSHTA to deliver malware that collects browser credentials, tokens and sensitive files.
Key points
- Microsoft observed increased ACR Stealer attacks against enterprise customers between late April and mid-June.
- One reported delivery chain uses a ClickFix lure to run a malicious DLL from a remote WebDAV share via rundll32.exe; GUID-based paths and filenames can mimic legitimate resources.
- Another chain uses ClickFix to launch MSHTA, retrieve malicious content and run an obfuscated PowerShell downloader.
- Microsoft says the activity can use an obfuscated PowerShell script, a bundled Python loader, a scheduled task for persistence, and process injection for in-memory execution.
- In the second chain, an encrypted payload is concealed in a publicly hosted steganographic JPEG and executed in memory; some variants use public blockchain services to locate payloads or C2 addresses.
- The malware targets browser passwords, cookies and authentication tokens, as well as PDFs, Microsoft 365 documents, and files in Desktop, Downloads, OneDrive and SharePoint directories. Collected data is archived for intended exfiltration.
- Microsoft recommends blocking low-reputation or new domains, limiting unnecessary online resources, restricting remote script-execution tools, and warning users against running commands from ClickFix prompts.
Article Details
- Attack Vectors
- ClickFix lures prompt users to execute commands that launch a malicious DLL from a remote WebDAV share using rundll32.exe.
- ClickFix lures launch MSHTA, which retrieves malicious content from an attacker server and runs an obfuscated PowerShell downloader.
- A malicious payload is concealed in a publicly hosted steganographic JPEG image and executed in memory.
- Some variants use public blockchain services as dead-drop resolvers to retrieve updated payload locations or C2 addresses.
- Defensive Notes
- Warn users not to copy and execute instructions in command interpreters, especially instructions presented as error fixes or human-verification steps.
- Enforce web filters and block low-reputation or newly registered domains; restrict access to online resources not required for business operations.
- Use application control to restrict PowerShell, Python, mshta.exe, and rundll32.exe from launching content from remote resources, particularly from user-writable paths.
MITRE ATT&CK
T1005 · Data from Local SystemThe malware searches for local documents and collects files from Desktop and Downloads folders.T1027.003 · SteganographyAn encrypted payload is concealed inside a steganographic JPEG image.T1036.004 · Masquerade Task or ServiceThe scheduled task is masked as a software update.T1053.005 · Scheduled TaskThe malware creates a scheduled task disguised as a software update to establish persistence.T1055 · Process InjectionThe final payload is injected into a system process for in-memory execution.T1059.001 · PowerShellObfuscated PowerShell scripts launch the installer or downloader.T1070.003 · Clear Command HistoryThe malware clears PowerShell history.T1070.006 · TimestompThe malware manipulates timestamps.T1102.001 · Dead Drop ResolverSome variants use public blockchain services as dead-drop resolvers for updated payload locations or C2 addresses.T1105 · Ingress Tool TransferThe campaigns retrieve a malicious DLL or content from remote WebDAV or attacker-hosted resources.T1204.004 · Malicious Copy and PasteClickFix lures rely on users copying and executing commands in a command interpreter.T1218.005 · MshtaOne delivery chain uses MSHTA to retrieve and execute malicious content.T1218.011 · Rundll32A ClickFix command uses rundll32.exe to run a malicious DLL from a remote WebDAV share.T1539 · Steal Web Session CookieThe malware steals browser cookies and session data.T1555.003 · Credentials from Web BrowsersACR Stealer targets passwords and browser data, including data from Chrome and Edge databases.T1560 · Archive Collected DataCollected data is archived in preparation for exfiltration.
Malware
ACR (AcridRain) StealerMicrosoft has observed a surge in attacks using ACR Stealer, which targets browser passwords, authentication tokens, and sensitive business documents.Amatera StealerThe malware is delivered through ClickFix lures, WebDAV servers, and MSHTA, and is believed to be a rebranding of Amatera Stealer.
Vendors
Products
EdgeAccess Chromium browser databases on Chrome and EdgeGoogle ChromeAccess Chromium browser databases on Chrome and EdgeMicrosoft 365 Apps for EnterpriseSearch for PDFs and Microsoft 365 documentsMicrosoft OneDriveTarget enterprise-synchronized OneDrive and SharePoint directoriesMicrosoft SharePointTarget enterprise-synchronized OneDrive and SharePoint directories
Tools
mshta.exeThe malware is delivered through ClickFix lures, WebDAV servers, and MSHTA, and is believed to be a rebranding of Amatera Stealer.PowerShellAfter establishing communication with the command-and-control (C2) infrastructure, “a heavily obfuscated PowerShell script” is executed to launch a malware installer and establish persistence.PythonThe routine installs a bundled Python loader, creates a scheduled task masked as a software update, manipulates timestamps, clears PowerShell history, and injects the final payload into a system process for in-memoryRundll32The first campaign starts with a ClickFix lure that executes a command to run a malicious DLL from a remote WebDAV share using rundll32.exe.