ClickFix Lures Spread ACR Stealer in Two Chains

How the Attack Worked

Microsoft observed a rise in ACR Stealer activity from late April 2026 to mid-June 2026 across customer environments. Both documented intrusion chains start with a ClickFix-style prompt on a website, likely reached through malvertising or SEO-manipulated search results. The prompt tells the user to copy and paste a command to verify or fix an issue on their device.

In the first chain, the pasted command launches cmd.exe, which then invokes rundll32.exe to load a DLL from a remote WebDAV share over HTTPS. From there, the attacker uses staged, heavily obfuscated PowerShell and Python-based loaders, with persistence sometimes set up as a scheduled task disguised as a software update.

In the second chain, the command starts mshta.exe to fetch and run remote HTA content. An embedded VBScript loader abuses COM objects to decode and execute encoded PowerShell. This chain also uses steganography, hiding a malicious payload inside an image hosted on a public image-hosting service, allowing much of the execution to happen in memory.

Why It Succeeded

Both chains rely on the user doing the actual work of running the malicious command themselves, which can bypass some technical controls that focus on blocking downloads or attachments. The prompts appear as routine verification or fix steps, and the use of malvertising or manipulated search results means the lure can reach users who are simply searching for something unrelated. Using built-in Windows tools like cmd.exe, rundll32.exe, and mshta.exe also helps the activity blend in with normal system behavior.

What to Watch For

• A website or pop-up instructing you to copy and paste a command to fix or verify something
• Instructions that involve opening cmd.exe, PowerShell, rundll32.exe, or mshta.exe
• Unexpected scheduled tasks disguised as software updates
• Unusual network activity involving WebDAV shares or image-hosting services

How to Build Resistance

Organizations should educate users to treat any paste-and-run instruction as suspicious, especially when it references command interpreters or script hosts. Reducing reliance on browser-stored credentials, enforcing multifactor authentication, and applying conditional access can limit the value of stolen credentials and tokens. Reducing exposure to malvertising and SEO poisoning through web filtering also helps cut off the initial delivery path.

If a device is suspected of running one of these commands, isolate it, rotate exposed credentials, and revoke potentially compromised tokens quickly to limit the impact of credential and document theft.

What is a ClickFix prompt?

It is a social engineering technique where a website tells the user to copy and run a command, often framed as a fix or verification step, that actually launches malware.

What does ACR Stealer target?

The campaigns aim to steal browser-stored credentials, authentication tokens, and sensitive documents including PDFs and Microsoft 365 files.

How do the two ACR Stealer chains differ?

One chain loads a DLL from a remote WebDAV share and later uses PowerShell and Python-based loaders, while the other uses MSHTA to fetch remote HTA content and hides a payload inside an image using steganography.

What should someone do if they ran a suspicious command?

Isolate the affected device, rotate exposed credentials, and revoke potentially compromised tokens as soon as possible.