Microsoft Warns of ACR Stealer Malware Attacks
Microsoft has observed a surge in attacks using the ACR Stealer malware to steal sensitive data from its enterprise customers. The malware is believed to be a rebranding of the Amatera Stealer malware and is delivered through various methods, including the ClickFix social-engineering method, WebDAV servers, and the MSHTA utility.
Delivery Methods
There are multiple delivery methods for the malware, but Microsoft highlights two intrusion chains as the most prevalent. The first campaign starts with a ClickFix lure that executes a command to run a malicious DLL from a remote WebDAV share using rundll32.exe. The threat actor uses a GUID-based directory structure and filenames in the WebDAV path to mimic legitimate resources and blend the activity with expected network traffic.
After establishing communication with the command-and-control (C2) infrastructure, a heavily obfuscated PowerShell script is executed to launch a malware installer and establish persistence. The routine installs a bundled Python loader, creates a scheduled task masked as a software update, manipulates timestamps, clears PowerShell history, and injects the final payload into a system process for in-memory execution.
Second Delivery Chain
The second delivery chain uses ClickFix to launch MSHTA, which retrieves malicious content from the attacker's server and executes an obfuscated PowerShell downloader. The malware then extracts an encrypted payload concealed inside a publicly hosted steganographic JPEG image and executes it directly in memory.
Objective and Impact
Despite the differences in delivery methods, the objective of the ACR Stealer malware remains the same: to steal sensitive data, including passwords, cookies, session data, and authentication tokens stored on web browsers. The malware also decrypts browser data through the Windows Data Protection API (DPAPI) and accesses Chromium browser databases on Chrome and Edge.
The malware collects and archives data in preparation for exfiltration to the attacker. Microsoft warns that these two campaigns represent some of the most prevalent ACR Stealer delivery campaigns observed, but notes that additional execution chains are likely to exist.
Defense and Mitigation
As a general defense rule against ClickFix attacks, users should avoid copying and executing instructions in command interpreters, especially when they claim to fix an error or verify that they are human. Microsoft recommends that organizations reduce exposure to web-based delivery chains by enforcing filters, blocking low-reputation or new domains, and restricting access to online resources that are not required for business operations.
Application control rules can restrict launching content from a remote resource using tools like PowerShell, Python, mshta.exe, or rundll32.exe, especially from user-writeable paths. Microsoft's report provides a larger list of recommended mitigations along with a set of indicators of compromise specific for the observed ACR Stealer activity.
Test every layer before attackers do. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
- New ClickLock macOS malware traps users into revealing login password
- Nearly 300 GitHub repos pose as legit software to push malware
- Critical SimpleHelp flaw exploited to deploy new stealer malware
- Steam Workshop abused to spread malware via Wallpaper Engine app
Source: BleepingComputer