Microsoft has warned enterprise customers about a surge in ACR Stealer campaigns that leverage ClickFix malware tactics to trick users into executing malicious commands. These lures typically instruct victims to copy and paste attacker-provided commands into the Windows Run dialog (Win + R) or Windows Terminal, allowing the malware to execute without exploiting a software vulnerability. Attackers then abuse trusted Windows utilities such as rundll32.exe, mshta.exe, and PowerShell to quietly deploy malware that steals credentials, browser session data, and sensitive business documents.<\/p>\n
The campaign highlights a growing trend in modern cyberattacks: compromising identities instead of merely stealing passwords. By targeting browser cookies, authentication tokens, and synchronized Microsoft 365 content, attackers can gain persistent access to enterprise resources even when organizations enforce strong password policies and multi-factor authentication.<\/p>\n