ClickFix Lure Drives New ACR Stealer Waves

How the attack worked

Microsoft observed two separate ACR Stealer campaigns running from late April to mid-June 2026, both built around the same core trick known as ClickFix. A prompt, typically encountered on a website, tells the user there is a problem and instructs them to run a command, often PowerShell, to fix it. Once the victim copies and pastes that command, the infection chain begins.

What made these campaigns notable is that the two waves used different post-execution methods. One relied on WebDAV-hosted DLLs combined with PowerShell and Python loaders and scheduled tasks to maintain persistence. The other used MSHTA and fileless, in-memory execution to reduce the forensic trail left behind. Despite these technical differences, both chains depended entirely on getting a user to execute a malicious command themselves.

Why it succeeded

The core reason this lure works is that it mimics normal troubleshooting behavior. Users are accustomed to being told by a website or application that something needs to be fixed, and copy-pasting a suggested command feels like a reasonable, low-effort response. Because the attack does not exploit any software vulnerability, and depends solely on social engineering, traditional patching and vulnerability management offer no protection here.

The varying execution methods also help the campaigns evade detection tuned to a single known chain, and can make related incidents appear disconnected from each other even though they share the same lure and objective.

What to watch for

• A webpage or prompt asking you to run commands on your computer to resolve an issue
• Unexpected instructions to copy and paste PowerShell or other commands into a terminal
• A “fix” that does not match your organization’s normal IT support process
• Unusual PowerShell, MSHTA, or WebDAV activity on endpoints
• Attempts to access browser-stored credential data

Once executed, the malware extracts browser-stored credentials, session tokens, and documents, which can allow attackers to access cloud services, impersonate users, and conduct follow-on intrusions across enterprise environments.

How to build resistance

Organizations should train employees, IT helpdesk staff, and finance teams to never run copy-paste “fix” commands from pop-ups or unfamiliar websites, and instead contact IT through established, known channels. Because attackers can change delivery and execution patterns (T1204.001, T1059.001, T1218.005, T1053.005) while keeping the same lure, awareness training should focus on the underlying behavior, being asked to execute commands, rather than the exact appearance of any single message. Security operations teams should also monitor for PowerShell, MSHTA, and WebDAV activity alongside attempts to access browser credential stores, since these are the operational signals tied to this lure regardless of which execution chain follows it.

What is the ClickFix lure used in these ACR Stealer campaigns?

It is a fake prompt claiming there is a problem on the user's system, instructing them to copy and paste a command to fix it. Running that command triggers the malware chain.

Does ACR Stealer exploit a software vulnerability?

No. Microsoft reported that neither campaign exploits any software vulnerability, relying solely on ClickFix-based social engineering to get users to execute commands.

What data does ACR Stealer steal once executed?

Once executed, the malware extracts browser-stored credentials, session tokens, and documents, which can allow attackers to access cloud services, impersonate users, and conduct follow-on intrusions.

Why are the two ACR Stealer campaigns hard to connect?

One chain used WebDAV-hosted DLLs with PowerShell and Python loaders and scheduled tasks, while the other used MSHTA and fileless, in-memory execution, so the differing delivery and execution patterns make related incidents look disconnected.