The ACR Stealer campaign shows how ClickFix-style social engineering is becoming a reliable delivery method for credential theft and cloud-data compromise.

ClickFix attacks work by presenting users with fake verification, browser-check, or error-resolution pages. These pages often look like normal Cloudflare, Google, CAPTCHA, or system prompts, but they instruct the user to copy and paste a command into Windows Run, PowerShell, or another command interface. Once the user follows the instruction, the malware installation begins.

This matters because the attack bypasses many normal user suspicions. The victim is not opening a suspicious attachment or downloading an obviously malicious file. They believe they are completing a verification step or fixing a browser issue. In reality, they are manually executing attacker-provided code. Apparently, malware has discovered that the easiest installer is still a confused human with a clipboard.

ACR Stealer is designed to collect sensitive information from infected systems. The reported campaign focuses on stealing browser tokens and Microsoft 365 files, which makes it especially dangerous for business environments. Browser tokens and session cookies can allow attackers to access accounts without needing to know the user’s password again.

Microsoft 365 access is particularly valuable because it can expose email, OneDrive files, SharePoint data, Teams content, documents, spreadsheets, internal communication, customer records, and business workflows. A compromised Microsoft 365 account can quickly become a gateway for data theft, phishing, invoice fraud, business email compromise, and lateral movement.

The risk is not limited to the infected endpoint. If stolen tokens allow attackers to access cloud services, they may operate from outside the victim’s device and continue accessing data even after the malware is removed. That is why incident response must include token revocation, session termination, and cloud-log review, not just endpoint cleanup.

Organizations should train users with one very clear rule: no legitimate CAPTCHA, browser check, security verification, or website error message will ask them to paste commands into Windows Run or PowerShell. Any page asking for that should be treated as malicious by default.

Security teams should monitor for suspicious PowerShell execution, mshta, rundll32, wscript, cscript, curl, certutil, bitsadmin, unusual browser child processes, and commands launched immediately after visiting unfamiliar websites. They should also watch for abnormal access to browser profile folders, credential stores, cookies, and temporary directories.

For Microsoft 365 environments, defenders should review risky sign-ins, unusual file downloads, impossible-travel alerts, mass access to OneDrive or SharePoint files, suspicious mailbox activity, unexpected OAuth grants, and access from unfamiliar devices or residential proxy networks.

If infection is suspected, organizations should revoke active sessions, rotate passwords from clean systems, reset MFA where needed, review conditional-access policies, remove suspicious OAuth applications, and inspect Microsoft 365 audit logs for data access after the suspected compromise time.

Endpoint controls should restrict unnecessary script execution, reduce local administrator rights, block risky command patterns, enforce browser protection, and use DNS or web filtering to stop access to known malicious infrastructure. Application control and EDR rules should specifically cover ClickFix behavior, not just traditional malware file signatures.

The key lesson is that credential theft has moved beyond password stealing. Attackers now target tokens, sessions, browser data, cloud files, and the trust relationships users already have with SaaS platforms. A password reset may not be enough if the attacker has already stolen an active session.

ACR Stealer is another reminder that cloud security and endpoint security are now inseparable. If an endpoint is tricked into running malware, the attacker may immediately reach cloud data. If cloud sessions are not monitored and revoked, the compromise may continue even after the laptop looks clean.

ClickFix attacks succeed because they turn security theater into malware delivery. The page looks like protection, the instruction sounds technical, and the victim does the execution manually. Organizations need awareness, endpoint controls, and cloud-session monitoring working together, because attackers are no longer only breaking in. They are asking users to open the door and then thanking them for the help.

ACR Stealer, an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced OneDrive and SharePoint folders. It gets in because someone pasted a command into a Run box and pressed Enter. Microsoft laid out two of the delivery chains on Thursday. Its Defender Experts team, the

Source: ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files via The Hacker News — published 17 Jul 2026.