From late April through mid-June 202620262026, Microsoft Defender Experts observed the malware targeting browser passwords, cookies, authentication tokens, and sensitive documents.
A successful infection could allow attackers to hijack accounts, access cloud services, and launch further activity within an organization.
ACR Stealer, reportedly sold as malware-as-a-service and linked to the rebranded Amatera Stealer, appeared in two prominent attack chains.
Both trick users into manually running a malicious command, but they use different delivery and evasion techniques after initial access.
ACR Stealer Hides in JPEGs
The second campaign starts with a ClickFix lure, often delivered via malicious ads or search engine poisoning. Victims may be shown a fake verification message that instructs them to copy and paste a command into Windows Run or a terminal.
That command launches mshta.exe, a legitimate Windows utility that can execute HTML Application files.
MSHTA retrieves remote HTA content from attacker-controlled infrastructure, where embedded VBScript uses Windows COM objects to decode and launch PowerShell.
The PowerShell code is heavily obfuscated with randomized variable names, fake control-flow paths, arithmetic operations with no practical purpose, and custom encryption.
These measures make it harder for security products and analysts to understand the script.
Instead of downloading an obvious second-stage script or executable, the malware retrieves a JPEG from a public image-hosting platform.
The image appears benign, but its pixel data contains an encrypted malicious payload. The PowerShell stage extracts the hidden data, decrypts and decompresses it, then runs it directly in memory.
This combination of steganography and memory-only execution minimizes disk artifacts.
The final payload dynamically resolves Windows APIs such as LoadLibrary, GetProcAddress, VirtualAlloc, and CreateThread to load and execute shellcode reflectively. As a result, traditional file-based scanning may have fewer opportunities to detect the attack.
Once active, ACR Stealer targets Chromium browser databases, including Chrome and Edge Login Data and Web Data files.
It uses Windows Data Protection API, or DPAPI, activity to recover stored passwords, cookies, and session tokens.
Stolen session tokens can be especially dangerous because they may enable account access even where multifactor authentication is enabled.
The malware also searches Desktop and Downloads folders for high-value PDF files. Microsoft said the activity suggests targeted collection and staging of sensitive user documents before exfiltration.
Indicators of Compromise
| Campaign | IOC Type | Indicator | Description |
|---|---|---|---|
| Campaign 1 | C2 domain | looksta[.]icu | Command-and-control domain |
| Campaign 1 | C2 domain | contrite.quirksturdy[.]icu | Command-and-control domain |
| Campaign 1 | C2 domain | ux.strainedeasily[.]icu | Command-and-control domain |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
