Executive Summary
Microsoft Defender Experts and SANS ISC have observed a surge in ACR Stealer activity, an information-stealing malware-as-a-service (MaaS) rebranded from Amatera Stealer. The threat primarily spreads via 'ClickFix' lures—fake browser update or software fix prompts delivered through malvertising and SEO poisoning. These lures trick users into executing malicious commands that initiate multi-stage infection chains designed to harvest browser credentials, authentication tokens, and sensitive enterprise files.
Two primary intrusion chains have been identified: one utilizing WebDAV shares for payload delivery and blockchain-backed 'EtherHiding' for C2 resolution, and another utilizing MSHTA and steganography to execute payloads entirely in memory. The malware targets Chromium-based browser data and Windows DPAPI secrets while also searching for specific file types such as PDFs and Microsoft 365 documents for exfiltration.
This threat is significant due to its sophisticated evasion techniques, including the use of headless console windows, timestomping, and encrypted payloads hidden within JPEG image pixels. The use of decentralized blockchain infrastructure for C2 resolution makes traditional domain-based takedowns more difficult for defenders.