ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
ACR Stealer, an infostealer active since 2024, is leveraging deceptive lures – primarily mimicking Claude AI assistant pages and fake CAPTCHAs – to steal browser credentials, Microsoft 365 files, and sensitive documents. The attacks involve users pasting commands into the Run dialog, leading to a complex chain of events including DLL downloads, in-memory execution, and leveraging public blockchain infrastructure. Microsoft's Defender Experts have observed this activity since April/May 2024, with Red Canary documenting similar behavior weeks earlier. The threat actors behind ACR Stealer have shifted ownership and rebranded as Amatera Stealer, but the underlying techniques remain consistent. Mitigation involves blocking the Run prompt, restricting PowerShell and related tools, and actively hunting for suspicious rundll32.exe activity.
Microsoft is reporting activity related to ACR Stealer, an infostealer that has been active since 2024, and is currently leveraging deceptive lures to steal sensitive data. The attacks rely on users pasting commands into the Run dialog, triggering a complex sequence of events. The primary delivery method involves mimicking Claude, Anthropic's AI assistant, through fake pages on sites like claude-desktop[.]gitlab[.]io, and also using fake CAPTCHAs.
What happened
ACR Stealer operates by tricking users into executing malicious code. The initial step involves a user pasting a command into the Run box and pressing Enter. This launches a complex chain of events, including DLL downloads, in-memory execution, and leveraging public blockchain infrastructure. Microsoft's Defender Experts have been tracking this activity since late April/early May 2024, and Red Canary documented similar behavior weeks earlier.
The attacks utilize deceptive lures, primarily mimicking Claude, Anthropic's AI assistant, through fake pages on sites like claude-desktop[.]gitlab[.]io, and also using fake CAPTCHAs. The primary delivery method involves users pasting a command into the Run box and pressing Enter. This launches a complex chain of events, including DLL downloads, in-memory execution, and leveraging public blockchain infrastructure.
Two distinct chains have been identified. The first involves writing to disk, leaving defenders with more data to analyze. The second chain relies on in-memory execution, making detection more challenging. Both chains utilize DLL downloads from WebDAV shares and extract data from image-hosting services like ImgBB. The attacks also leverage public blockchain RPC endpoints and Web3 node infrastructure to pull payloads or C2 addresses.
Red Canary's April telemetry showed a cluster, ClearFake, delivering ACR Stealer through JavaScript injected into compromised sites. Microsoft's report does not mention this cluster. The threat actors behind ACR Stealer have shifted ownership and rebranded as Amatera Stealer, with sales priced from $199 a month to $1,499 a year.
Neither chain exploits a vulnerability; they both rely on a user executing a command. The attacks are designed to be persistent and difficult to detect, with techniques like timestomping and PowerShell history clearing.
What to do
- Cut the vector: Remove the Run prompt via GPO and block mshta.exethrough AppLocker or WDAC.
- Use application control and attack surface reduction rules so PowerShell, Python, mshta.exe, and rundll32.exe cannot launch internet-delivered content from Downloads, Temp, or %LocalAppData%.
- Hunt rundll32.exe running with no command-line parameters while making a network connection.
- On a suspected host, isolate, rotate credentials, revoke tokens, and check outbound connections to remote shares and image-hosting services.
What it matters
The continued evolution and rebranding of ACR Stealer highlight the persistent threat landscape and the adaptability of malicious actors. The reliance on deceptive lures underscores the importance of user awareness and robust security controls to prevent successful attacks. The fact that the threat actors have shifted ownership and rebranded demonstrates the ongoing commercialization of malware and the difficulty in tracking down the original source. The report provides a snapshot of the current activity, but more campaigns and infrastructure are likely active.