ACR Stealer Surge Targets Enterprise Credentials

Microsoft observed a surge in ACR Stealer attacks from late April to mid-June, using ClickFix lures to steal browser passwords, authentication tokens, and documents from enterprise customers. The malware-as-a-service operation, a rebranding of Amatera Stealer, delivers payloads via WebDAV servers or steganographic JPEG images, with variants using blockchain dead-drop resolvers for C2 addresses.