In July 2026, Microsoft warned of a significant surge in ACR Stealer activity targeting its customers, with campaigns observed between late April and mid-June 2026 using social engineering techniques that had grown considerably more capable than the stealer's earlier versions. ACR Stealer has been in circulation since 2024, but the campaigns Microsoft's Defender Experts observed represent a clear evolution in delivery sophistication, combining ClickFix social engineering, image steganography, and in some variants, blockchain-based command and control infrastructure to make the stealer harder to detect and the stolen data harder to attribute.
What makes ACR Stealer particularly relevant from a dark web monitoring and threat intelligence perspective is what it targets and what happens to that data afterwards. The stealer is not primarily hunting passwords stored in a browser's local password manager. It is taking live session tokens, the authentication cookies that let a logged-in session continue without re-entering credentials or completing multi-factor authentication. Those tokens, extracted from an employee's browser while they are actively logged into Microsoft 365, OneDrive, and SharePoint, are immediately usable by whoever purchases the resulting log on a criminal market. No password required. No MFA to bypass. The session is already authenticated.
ClickFix is a social engineering technique that has been refined across multiple threat actor operations since it first emerged widely in 2025. The core mechanic is deceptively simple: the victim encounters what appears to be an error message or a verification prompt, often on a compromised website or in a phishing page, and is instructed to "fix" the issue by pressing a keyboard shortcut and pasting a command. On Windows, this typically involves pressing Win+R to open the Run dialogue, pasting a PowerShell or command-line payload, and pressing Enter.
The social engineering power of ClickFix comes from the instruction interface itself. The victim performs the action themselves, using legitimate Windows functionality. There is no file attachment to open, no macro to enable, and no executable to run. The security training message about not opening attachments from unknown senders does not apply because the victim is pasting a command, not opening a file. The result is that ClickFix achieves code execution rates that traditional phishing delivery methods struggle to match.
In ACR Stealer's ClickFix campaigns, Microsoft identified two distinct delivery chains. The first uses a WebDAV file share to host the payload, with the ClickFix prompt instructing the victim to run a command that fetches and executes content from the remote share using Windows' built-in file handling. The second chain uses Microsoft HTML Application Host, MSHTA.exe, to execute an HTML application fetched from a remote source. MSHTA is a signed Microsoft binary, which means execution of MSHTA with a remote URL as argument is less likely to trigger application control policies than execution of an unknown binary.
One of the more technically distinctive aspects of ACR Stealer's recent campaigns is the use of JPEG steganography to conceal the payload. Steganography is the practice of hiding data within an innocuous carrier file. In this case, the ACR Stealer payload is embedded within the pixel data of a standard JPEG image. When the image is downloaded and processed by the loader component, the hidden payload is extracted and executed in memory.
The practical security implication of steganographic delivery is that the malicious payload arrives at the endpoint inside a file type that many security tools treat as low-risk. JPEG files are used throughout web browsing, and blocking them is not a practical control. More importantly, the initial download event looks like an image request: a legitimate URL, a legitimate Content-Type header, a valid JPEG structure. Network-level detection that relies on file type analysis or file extension filtering will not flag the download. Only tools that inspect the content of images for embedded executable patterns, or that monitor what happens to the data after the image is processed in memory, can catch this delivery mechanism.
The combination of ClickFix for initial code execution and steganographic delivery for the payload represents a deliberate effort to stay below the detection threshold of common enterprise security stacks. The endpoint never downloads a file with an obviously malicious extension. The network never sees an executable transfer. The victim performs the initial execution step themselves, through a legitimate Windows interface.
Once running on an endpoint, ACR Stealer targets a specific set of high-value data categories. The stealer extracts saved passwords from all major browsers, but the more immediately valuable targets are the session cookies and authentication tokens that allow an attacker to impersonate a logged-in user without knowing the underlying password. On a machine where an employee is signed into Microsoft 365 through a browser session, those tokens give the buyer of the resulting log access to the employee's email, SharePoint sites, Teams messages, OneDrive files, and any other application that uses the same Microsoft authentication session.
Beyond browser credentials, ACR Stealer explicitly targets PDFs and Microsoft Office documents, as well as files from OneDrive and SharePoint that are synced to the local machine. For enterprises that store sensitive documents in SharePoint and sync working copies to employee machines, this means that a single endpoint infection can produce an infostealer log that contains both the authentication tokens to access the SharePoint environment and copies of the documents that were locally synced at the time of infection.
The resulting log is packaged and sold on infostealer markets, often within hours of the infection. Criminal markets that specialise in infostealer logs offer search functionality that allows buyers to filter logs by domain, meaning that a buyer who wants access to a specific organisation's Microsoft 365 environment can search for logs containing credentials from that organisation's email domain. The price for a targeted log is typically a few hundred dollars, though logs from high-value organisations or those containing verified-active session tokens command higher prices.
Some ACR Stealer variants have adopted the same blockchain-based command-and-control technique documented in the TELEPUZ malware analysis: using a smart contract on a public blockchain to store the real C2 server address in an encrypted field. When the malware needs to communicate with its operator, it reads the smart contract's current state rather than connecting to a hardcoded IP address. Blockchain records are permanent and public, making the C2 coordination mechanism extremely resilient: there is no domain to seize and no hosting provider to contact for a takedown.
For threat intelligence teams tracking ACR Stealer infrastructure, this design means that the traditional approach of identifying and blocking C2 IP addresses or domains becomes less effective. The on-chain address can be updated by the operator without any disruption to existing infections, allowing the operator to cycle through hosting providers while the malware simply reads the new address from the immutable on-chain record.
Several detection opportunities exist for ACR Stealer campaigns, though none individually provides complete coverage. At the endpoint, monitoring for MSHTA.exe making outbound connections to external IP addresses is a high-fidelity signal: MSHTA has limited legitimate use in modern enterprise environments, and any instance of it fetching and executing content from an external source is worth immediate investigation. Similarly, monitoring for PowerShell or cmd.exe spawning from the Windows Run dialogue, particularly when the command includes a remote URL, can catch ClickFix attempts before the payload is delivered.
At the network level, the pattern of an employee browser session generating an authentication token followed shortly by the same token being used from an unfamiliar IP address is the post-infection signal that the session has been hijacked. Microsoft's Azure Active Directory sign-in logs surface this as an "impossible travel" alert when the two access events are geographically distant, but organisations that have not configured identity-based alerts may not see this signal without actively monitoring for it.
Dark web monitoring provides a parallel detection path that operates after the infostealer log has been sold but before the buyer has acted on its contents. Monitoring criminal markets for logs containing your organisation's domain in the credential fields or for mentions of specific services your employees use can surface an infection that endpoint detection missed. The window between when a log is listed for sale and when a buyer acts on the credentials it contains is often measured in days, and rapid detection of your organisation's data in a freshly listed log provides time to revoke the affected sessions before the buyer uses them. Understanding your credential exposure posture is the necessary complement to endpoint detection for this class of threat.
ACR Stealer does not operate in isolation. It is one of over 30 active infostealer strains currently listed on criminal markets, each with its own target list, delivery mechanism, and market positioning. What they share is the fundamental business model: infect an endpoint, extract everything of value, package it as a log, and sell it to buyers who will use the contents for account takeover, corporate intrusion, fraud, or resale to further parties.
The aggregate output of this ecosystem is significant. Security researchers estimated that more than 11.1 million devices were infected with infostealers in 2025, producing over 3.3 billion stolen credentials and associated data items that now circulate across dark web markets. Infostealer logs feed a secondary market of credential brokers who specialise in filtering, verifying, and reselling targeted subsets of the data to buyers with specific needs. A broker who has obtained a bulk log purchase can offer a service that lets a buyer search for credentials from a specific organisation and purchase only the matching rows.
For organisations that use Microsoft 365 and have employees working from personal devices or from devices where browser-based credential storage is active, the likelihood that at least some credentials from the organisation appear in infostealer logs at any given time is not negligible. Monitoring for that exposure continuously, rather than checking once a quarter against known breach databases, is the operational posture that matches the speed of the infostealer log market.
Enterprise security teams that have deployed EDR solutions across their managed device fleet have a reasonable degree of visibility into process execution, network connections, and file system activity on those devices. The challenge that infostealer campaigns expose is the structural gap between what EDR covers and what it does not. EDR typically covers corporate-managed Windows devices that have been enrolled in the organisation's management platform. It does not cover personal devices that employees use to access corporate resources through personal Microsoft accounts, work accounts configured for home use, or corporate applications that permit personal device access. It does not cover devices used by contractors, partners, or vendors who have access to shared systems. And it does not cover the cases where a managed device is infected through a vector that EDR does not flag, which happens with increasing frequency as delivery mechanisms like ClickFix exploit human action rather than software vulnerabilities.
The result is that even organisations with mature EDR deployments have meaningful blind spots in their infostealer coverage. The devices that fall outside EDR coverage are often the ones with the most valuable credentials: senior employees who use personal Macs for convenience, executives who access email on personal phones, contractors who have been given OAuth access to collaboration platforms without being required to enroll devices in corporate management. Infostealer operators are aware of these blind spots and deliberately target delivery mechanisms that reach personal devices, including social media links, compromised developer tools, and fake software download sites.
When dark web monitoring produces an alert that an employee's credentials or session tokens have appeared in an infostealer log on a criminal market, the response window is narrow. The playbook begins with immediate session revocation across all Microsoft 365 and connected services for the affected account, using the "Revoke all sessions" capability in Azure Active Directory. This terminates any session that may already be in use by someone who purchased the log before the alert was generated. Simultaneously, a forced password reset is triggered for the affected account, so that even if an attacker has the password from the log, they cannot use it after the reset completes.
The next step is forensic triage of the affected device if it is a managed device: reviewing the EDR timeline around the date of the infection (if estimable from the log's metadata), looking for the ClickFix execution pattern, the MSHTA network connection, or the JPEG download event that corresponds to ACR Stealer's delivery chain. If the device is unmanaged, the response shifts to verifying that the account's access has been fully revoked and reviewing audit logs for any access events that may have occurred using the stolen tokens between the infection date and the revocation.
The broader context of the alert, specifically which other services' credentials were captured alongside the Microsoft credentials, determines the scope of the response. If the log contains credentials for GitHub, AWS, or internal development tools alongside the Microsoft tokens, each of those services requires its own revocation and credential rotation. Infostealer logs are thorough by design, and a response that focuses only on the most visible credential (typically the corporate email) while missing the development tool access credentials leaves a lateral movement path open.
Threat intelligence feeds updated through July 2026 include ACR Stealer indicators in several categories that security teams can operationalise immediately. Network-level indicators include the WebDAV server addresses and MSHTA callback domains documented in Microsoft Defender Experts' report, which can be blocked at the perimeter and monitored for outbound connection attempts in historical firewall logs. Endpoint indicators include the file hashes for the ACR Stealer loader binary and the JPEG files used in steganographic delivery, which EDR platforms with threat intelligence integration can search for retroactively across available telemetry.
The most important ongoing monitoring posture, however, is behavioural rather than indicator-based. ACR Stealer's infrastructure changes between campaigns as operators cycle hosting to avoid blocklists. What remains consistent across variants is the behaviour: a user-initiated execution (the ClickFix step), followed by a network fetch to a remote resource from MSHTA.exe or a similar host process, followed by an outbound connection from the fetched payload to an exfiltration endpoint. This behavioural sequence is detectable in EDR telemetry without requiring knowledge of the specific IP addresses or file hashes used in any particular campaign variant.
Microsoft's July 2026 advisory noted that the surge in ACR Stealer activity coincided with the release of updated builder tooling that made it easier for less technically sophisticated operators to deploy campaigns with the JPEG steganography delivery chain. This democratisation of delivery sophistication is a recurring pattern in the infostealer market: capabilities that required significant technical skill to deploy in 2024 are packaged into point-and-click builders by 2026, expanding the pool of operators who can use them.
The practical implication for defenders is that ACR Stealer campaigns are likely to continue diversifying in terms of target sectors, delivery lures, and geographic focus. Rather than tracking ACR Stealer specifically, defenders should focus on the behavioural patterns that the stealer's architecture requires: a user-initiated execution step that relies on social engineering, a network fetch from a process that does not normally make outbound connections, and an exfiltration event that follows shortly after. These patterns are consistent across ACR Stealer variants and across many other infostealers that use similar architectures. Detecting the pattern rather than the specific indicator is the posture that scales across the full range of infostealer families currently active in the criminal marketplace.
The threats in this article share a common thread: they all depend on information that surfaces outside your perimeter before you have a chance to act on it. Infostealer logs containing your employees' session tokens appear on criminal markets within days of infection. Fraudulent domains imitating your brand go live before any internal team notices. Shadow IT assets sit exposed on the open internet because no one is looking outward from the right angle. And credential records from previous breaches circulate indefinitely, feeding the next wave of opportunistic attacks.
Defendis monitors dark web forums, criminal marketplaces, and breach data sources continuously for credentials, session tokens, and data linked to your organisation's domains. It surfaces fraudulent domains impersonating your brand before they become active phishing infrastructure. And it provides external visibility into your attack surface that complements what your internal tools see.
Book a demo to see how Defendis approaches dark web monitoring, brand protection, and external threat intelligence for enterprise security teams.
