As reported by The Hacker News, the ACR Stealer infostealer — active since 2024 — is currently leveraging ClickFix-style social engineering to compromise enterprise endpoints and walk out with browser credentials, active session tokens, and Microsoft 365 documents stored in OneDrive and SharePoint-synced folders.
Why This Campaign Is Particularly Dangerous
ClickFix as a delivery mechanism deserves serious attention precisely because it defeats most technical controls by design. The attack doesn't exploit a vulnerability in software — it exploits a vulnerability in human behavior. By convincing users to open a Run dialog and paste in a malicious command, attackers completely bypass browser-based download warnings, email attachment scanning, and endpoint detection that watches for suspicious file drops. The user becomes the execution engine.
What makes ACR Stealer especially concerning isn't just the delivery — it's the target scope. Stealing saved browser passwords is table stakes for modern infostealers. But harvesting live session tokens is a fundamentally different threat. Session tokens don't require a password. They don't trigger MFA. An attacker who captures a valid Microsoft 365 session token can authenticate directly to Exchange Online, Teams, SharePoint, and OneDrive with full user-level access — and do so from anywhere in the world with no secondary challenge.
"The theft of session tokens effectively renders MFA meaningless after the fact. Organizations that believe MFA protects them from credential theft need to rethink that assumption when infostealers are in the picture."
The M365 Document Exfiltration Angle
Targeting files in synced OneDrive and SharePoint folders elevates this from a credential-theft incident to a potential data breach event. In many enterprise environments, locally synced cloud folders contain contracts, HR records, financial models, source code, and merger documents. When ACR Stealer sweeps those directories, the blast radius extends far beyond the compromised endpoint — it encompasses everything the user had access to in the cloud, which in poorly scoped environments can be substantial.
This is also a supply chain risk vector. If a contractor, vendor, or third-party partner with access to a shared SharePoint site is compromised, the attacker inherits access to collaborative workspaces that span organizational boundaries.
Who Is Most at Risk
The Broader ClickFix Problem
ClickFix is no longer a niche technique — it has become a reliable first-stage delivery method for a wide range of malware families precisely because it's effective. Security teams that have hardened against phishing attachments and macro-enabled Office documents haven't necessarily trained users to be suspicious of "paste this into your Run box" instructions. That gap is being actively exploited.
The social engineering pretext typically mimics a CAPTCHA verification failure, a software update requirement, or an IT support remediation step — all scenarios where users feel pressure to comply quickly and don't stop to question the instruction.
Shield53 Recommendations
Immediate Actions
- Hunt for ClickFix execution patterns now: Search endpoint logs for PowerShell or cmd.exe processes spawned from explorer.exe or RuntimeBroker.exe — common indicators of Run-dialog execution. Look for encoded PowerShell strings and LOLBin abuse (mshta, wscript, curl, certutil).
- Audit active M365 sessions: Review Entra ID sign-in logs for anomalous session activity, particularly token refreshes from unexpected IP addresses or geographic locations. Revoke suspicious sessions immediately via the Microsoft 365 admin portal or PowerShell (
Revoke-AzureADUserAllRefreshToken). - Enable Continuous Access Evaluation (CAE): This Microsoft feature allows near-real-time revocation of access tokens when suspicious conditions are detected, significantly reducing the window of exposure from stolen tokens.
- Implement Conditional Access with token binding: Configure policies that require compliant, domain-joined devices and restrict token replay from non-registered devices.
- Restrict Run dialog usage via Group Policy: For environments where users have no legitimate need to run commands via Win+R, consider disabling or monitoring the Run dialog through Group Policy (User Configuration → Administrative Templates → Start Menu and Taskbar).
Longer-Term Controls
- Implement OneDrive and SharePoint data loss prevention (DLP) policies to alert on or block bulk file access and downloads.
- Conduct targeted user awareness training specifically covering ClickFix-style lures — show users what these prompts look like and make "never paste commands you didn't ask for" a cultural norm.
- Deploy Microsoft Defender for Cloud Apps (or equivalent CASB) to detect anomalous mass-download behavior from M365 services.
- Review and scope SharePoint permissions — minimize broad "Everyone" or organization-wide sharing that amplifies the damage from any single compromised account.
The ACR Stealer campaign is a sharp reminder that sophisticated infrastructure isn't required to cause serious enterprise damage. A convincing social engineering prompt, a user who follows instructions, and a poorly scoped cloud environment is all it takes. Defenders should focus their energy on reducing that attack surface before the next wave arrives.
