Microsoft has reported a significant increase in ACR Stealer malware attacks targeting business customers, aiming to steal passwords, authentication tokens, and sensitive documents stored in browsers.
Between late April and mid-June, attackers employed ClickFix social engineering techniques, compromised WebDAV servers, and used the Microsoft HTML Application Host (MSHTA) utility to deliver information-stealing malware.
ACR Stealer is a malware-as-a-service (MaaS) operation believed to be a rebranded version of Amatera Stealer.
Understanding ACR Stealer Attacks
Microsoft identifies two primary delivery methods for ACR Stealer malware.
The first campaign uses a ClickFix lure that invokes a command leveraging rundll32.exe to execute a malicious DLL from a remote WebDAV share.
Exploiting WebDAV is a common tactic, previously seen in campaigns deploying Bumblebee and Voldemort malware.
In the recent report, Microsoft outlines that perpetrators often utilize GUID-based directory structures and filenames in WebDAV paths to mimic legitimate domains (e.g., google.ct) to blend their activity with regular network traffic.
Once communication is established with the command-and-control (C2) server, a heavily obfuscated PowerShell script is executed, leading to the installation of the malware and ensuring persistence.
This process installs a bundled Python loader, generates a scheduled task disguised as a software update, manipulates file timestamps, clears PowerShell history, and injects the final payload into the system’s memory for execution.
Certain ACR Stealer variants utilize public blockchain services for dead drop resolvers, allowing them to retrieve updated payloads or C2 addresses, a tactic referred to as EtherHiding.
The second delivery chain also employs ClickFix, but this time to launch MSHTA, which retrieves malicious content from the attacker’s server and executes an obfuscated PowerShell downloader.
The malware extracts an encrypted payload hidden within a steganographic JPEG image hosted publicly and executes it directly in memory.
Ultimately, the aim remains the same: to steal sensitive data.
- Steal passwords, cookies, session data, and authentication tokens stored in web browsers.
- Decrypt browser data using Windows Data Protection API (DPAPI).
- Access Chromium browser databases in Chrome and Edge.
- Search through PDF and Microsoft 365 documents.
- Collect files from Desktop and Downloads directories.
- Target OneDrive and SharePoint folders for enterprise synchronization.
All collected data is archived with the intention of being released to an attacker.
Source: Microsoft
According to Microsoft, “These two campaigns represent some of the most commonly observed ACR Stealer delivery methods detected by Defender Expert, but they do not encompass all delivery techniques employed by this malware family.”
To defend against ClickFix attacks, users are advised to refrain from executing commands in a command interpreter, especially if they purport to fix errors or verify user identity.
Microsoft suggests organizations minimize exposure to web-based delivery systems by deploying filters, blocking suspicious or newly registered domains, and restricting access to online resources that are unnecessary for business operations.
Furthermore, application control rules can be enforced to limit the execution of content from remote resources via tools such as PowerShell, Python, mshta.exe, and rundll32.exe, particularly from user-writable paths.
Microsoft’s report includes a comprehensive list of recommended mitigations and indicators of compromise related to the observed ACR Stealer activity.
Security teams note that 54% of successful attacks go undocumented, issuing warnings for only 14%. The rest operate unnoticed within the environment.
Picus’ whitepaper discusses how to test your SIEM and EDR rules through breach and attack simulations to ensure threats are detected.
Source: www.bleepingcomputer.com