ClickFix Trick Spreads ACR Stealer via Paste-Run

How the Attack Worked

Microsoft documented two separate intrusion chains that both rely on the same core trick, known as ClickFix. Victims land on a fake page, often after clicking a malicious ad or a search result manipulated through SEO tactics, and are told to copy a command and paste it into the Windows Run box to resolve a supposed issue. One documented case involved a page impersonating Anthropic's Claude AI assistant, reached through malicious Google ads.

Once the victim pastes the command and presses Enter, the infection begins. One chain is largely fileless and can hide payload data inside a JPEG downloaded from an image-hosting service. The other pulls a DLL from a remote WebDAV share using a disguised filename, then persists through a hidden scheduled task made to look like a routine software update.

Why It Succeeded

The attack does not rely on any software vulnerability. As the reporting notes, neither chain exploits a vulnerability; it only runs because a person read a prompt and pressed Enter. This makes the technique effective against well-patched systems, since the weak point is human trust rather than a technical flaw. Malvertising and SEO manipulation also help the lure reach users who are actively searching for legitimate tools, making the fake page feel like a normal result rather than an unsolicited message.

What to Watch For

• Any prompt asking you to open Windows Run (Win+R) and paste a command, regardless of the stated reason
• Landing pages reached through search ads or top search results rather than a bookmarked or known URL
• Commands referencing rundll32.exe or a remote network path, including WebDAV-style addresses
• Scheduled tasks that appear to be software updates but were not initiated through normal update channels
• Brand impersonation pages, such as one mimicking an AI assistant's support flow

How to Build Resistance

Organizations and individuals can reduce risk from this style of attack with a few consistent habits:

• Treat any instruction to paste a command into Windows Run or a terminal as a likely scam and verify through official support channels first
• Use bookmarks or known URLs for services like Microsoft 365 and AI tools instead of relying on search results or ads
• If compromise is suspected, revoke session tokens rather than only changing passwords, since the malware can steal live session tokens
• Train staff, including IT helpdesk and general employees, to recognize that legitimate fixes rarely require manually pasting and running commands

Because the malware targets Microsoft 365 documents and synced OneDrive and SharePoint files in addition to browser credentials, security teams should pair user awareness training with monitoring for unusual scheduled tasks and token activity across cross-industry Microsoft 365 environments.

What is a ClickFix attack?

A ClickFix attack is a social engineering trick where a fake webpage or prompt instructs a user to copy a command and paste it into Windows Run to fix a supposed problem, which instead executes malware.

What does ACR Stealer take from infected systems?

According to Microsoft's findings, ACR Stealer collects saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders.

Why isn't changing my password enough after this attack?

Because the malware can steal live session tokens in addition to passwords, Microsoft advises revoking tokens rather than only rotating passwords.

How do victims typically encounter these ClickFix prompts?

The prompts arrive through malvertising or SEO-manipulated search results, including a page impersonating Anthropic's Claude reached through malicious Google ads.