Microsoft observed real-world ACR Stealer campaigns where users are tricked by “ClickFix” prompts into running attacker-provided commands. Two main intrusion chains were seen: one loads a DLL from a remote WebDAV share and later uses Python-based loaders, and the other uses MSHTA and an image-based (steganography) payload to run mostly in memory. The end goal in both is stealing browser credentials, session tokens, and sensitive documents for later misuse.
Microsoft observed a rise in ACR Stealer activity from late April 2026 to mid-June 2026 across customer environments. Both documented intrusion chains start with a ClickFix-style prompt on a website, likely reached through malvertising or SEO-manipulated search results. The prompt tells the user to copy and paste a command to verify or fix an issue on their device.
In the first chain, the pasted command launches cmd.exe, which then invokes rundll32.exe to load a DLL from a remote WebDAV share over HTTPS. From there, the attacker uses staged, heavily obfuscated PowerShell and Python-based loaders, with persistence sometimes set up as a scheduled task disguised as a software update.
In the second chain, the command starts mshta.exe to fetch and run remote HTA content. An embedded VBScript loader abuses COM objects to decode and execute encoded PowerShell. This chain also uses steganography, hiding a malicious payload inside an image hosted on a public image-hosting service, allowing much of the execution to happen in memory.
Both chains rely on the user doing the actual work of running the malicious command themselves, which can bypass some technical controls that focus on blocking downloads or attachments. The prompts appear as routine verification or fix steps, and the use of malvertising or manipulated search results means the lure can reach users who are simply searching for something unrelated. Using built-in Windows tools like cmd.exe, rundll32.exe, and mshta.exe also helps the activity blend in with normal system behavior.
Organizations should educate users to treat any paste-and-run instruction as suspicious, especially when it references command interpreters or script hosts. Reducing reliance on browser-stored credentials, enforcing multifactor authentication, and applying conditional access can limit the value of stolen credentials and tokens. Reducing exposure to malvertising and SEO poisoning through web filtering also helps cut off the initial delivery path.
If a device is suspected of running one of these commands, isolate it, rotate exposed credentials, and revoke potentially compromised tokens quickly to limit the impact of credential and document theft.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a social engineering technique where a website tells the user to copy and run a command, often framed as a fix or verification step, that actually launches malware.
The campaigns aim to steal browser-stored credentials, authentication tokens, and sensitive documents including PDFs and Microsoft 365 files.
One chain loads a DLL from a remote WebDAV share and later uses PowerShell and Python-based loaders, while the other uses MSHTA to fetch remote HTA content and hides a payload inside an image using steganography.
Isolate the affected device, rotate exposed credentials, and revoke potentially compromised tokens as soon as possible.
You search for a fix, click the top result, and a “ClickFix” box says: copy this command to fix the issue. That copy‑paste command quietly opens cmd.exe, then rundll32 from a WebDAV share, or mshta pulling a remote HTA file, ACR Stealer is now digging through your browser passwords and OneDrive docs. Here’s the tell: a web page that says, 'Open PowerShell or cmd and paste this,' especially if you see cmd, PowerShell, rundll32, or mshta in the text, that is not how real sites verify or fix anything. If any site tells you to paste a command like that, stop, close the tab and report it to security immediately so we can check your device.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Researchers reported an active, large-scale phishing campaign that starts with links hosted on legitimate Google services, then redirects victims to attacker-controlled sites. The final pages mimic Microsoft sign-in or “identity verification” flows to steal credentials/MFA codes or trick targets…
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
