ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer, an infostealer that has been in circulation since 2024, is stealing various sensitive data from enterprise networks, including browser passwords, session tokens, and Microsoft 365 documents. The malware is also accessing files from synced OneDrive and SharePoint folders. Initial access is gained when a user runs a command in the Run box. Microsoft's Defender Experts team has outlined two delivery chains used by the malware. The attack relies on social engineering tactics, specifically using ClickFix lures to trick users into executing the malicious command. The stolen data includes PDFs and other files stored in compromised accounts.