ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data
ACR Stealer (Amatera Stealer) Uses ClickFix Lures (TL-2026-1444), also tracked as AcridRain, is a high-severity malware campaign, first published 2026-07-17. It is attributed to SheldIO with medium confidence, affects Microsoft Windows (all supported client/server versions with browser, maps to 35 MITRE ATT&CK techniques (T1005, T1027, T1027.003), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-1444
- Threat ID
- TL-2026-1444
- Also known as
- AcridRain, Amatera Stealer, GrMsk Stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-17
- Last reviewed
- 2026-07-17
- Attribution
- SheldIO
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- enterprise, technology, finance, government administration, professional-services
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in ACR Stealer (Amatera Stealer) Uses ClickFix Lures
Malware and tooling: ACR Stealer, Amatera Stealer, GrMsk Stealer
ACR Stealer (formerly AcridRain, rebranded Amatera Stealer in June 2025) is being distributed via ClickFix social-engineering lures — including fake Claude AI / claude-desktop GitLab Pages sites — that trick users into pasting commands into the Windows Run dialog. Microsoft tracked two distinct intrusion chains between late April and mid-June 2026: a WebDAV/pushd/rundll32 disk-based chain using Python loaders and blockchain-backed (EtherHiding) dead-drop C2 resolution, and a fully fileless mshta/HTA/VBScript chain that hides its payload inside JPEG pixels hosted on ImgBB and executes it entirely in memory. The malware harvests browser credentials, session cookies, DPAPI secrets, and Microsoft 365/OneDrive/SharePoint documents.
How ACR Stealer (Amatera Stealer) Uses ClickFix Lures works
ACR Stealer is a commodity information-stealer first tracked as AcridRain and rebranded Amatera Stealer in June 2025 following an alleged marketplace shutdown by its operator, 'SheldIO', on Russian-speaking cybercrime forums in July 2024. eSentire has reported the source code was sold; Proofpoint assesses the original operator likely continued operations via a private Telegram channel, and the malware is also assessed by some researchers as an evolution of GrMsk Stealer. Amatera/ACR is sold as a subscription malware-as-a-service offering priced between $199 and $1,499 per year.
Between late April 2026 and mid-June 2026, Microsoft Defender Experts observed a marked increase in ACR Stealer activity delivered via the ClickFix social-engineering technique, in which victims are lured (via malicious Google Ads, compromised sites, or fake pages impersonating legitimate software such as Claude AI/Claude Code hosted on GitLab Pages under the trusted *.gitlab.io domain) into copying and pasting an attacker-supplied command into the Windows Run dialog, PowerShell, or Terminal. A related campaign observed by SANS ISC and Trend Micro abused over 92 unique GitLab Pages hostnames and the claude.ai shared-chat feature itself as a delivery/legitimacy layer, funneling more than 2,000 victims from sponsored search ads.
Microsoft documented two divergent post-ClickFix intrusion chains feeding the same ACR Stealer/Amatera payload family:
Campaign 1 (WebDAV/disk-based): The pasted command invokes cmd.exe, which uses rundll32.exe (or, in some variants, pushd to mount the remote share as a local drive letter) to load a DLL staged on a WebDAV share reachable over HTTPS at GUID-keyed paths (e.g. \\sphere-api.dialectosphere.in[.]net\05fe317c-0981-4de2-bc8a-930d369db441\ck-3d80df5d12cdfe6450a782fc87bf66b444.google). The stealthiest observed variant wraps execution in conhost.exe --headless with delayed environment-variable expansion for obfuscation. The DLL triggers an obfuscated PowerShell stage that drops a ZIP archive to %LocalAppData%\Temp under an innocuous directory name (e.g. LogiOptionsPlus), containing a bundled pythonw.exe runtime that silently launches a Python loader. Persistence is established via a hidden scheduled task disguised as a routine software-update task; the malware then copies file timestamps from notepad.exe (timestomping) and clears PowerShell history to hinder forensics. A subset of these intrusions use a secondary Python loader implementing EtherHiding — querying public blockchain RPC endpoints and third-party Web3 node infrastructure to resolve a dead-drop C2 address or follow-up payload stored on a public ledger (a technique pioneered by the ClearFake web-inject cluster, which has fed ACR Stealer since at least March 2025 and which Red Canary ranked the #1 most prevalent threat in its telemetry for April 2026).
Campaign 2 (fileless/steganographic): The pasted command spawns mshta.exe, which fetches a remote HTA payload from an attacker-controlled domain. An embedded VBScript loader uses COM objects to decode and launch PowerShell, which mints a victim-specific identifier, disables TLS/certificate validation, and downloads a JPEG image (hosted on ImgBB in observed samples) containing an encrypted payload hidden in the pixel data. Custom PowerShell routines extract, decrypt, and decompress the payload, then resolve Win32 APIs at runtime (LoadLibrary, GetProcAddress, VirtualAlloc) to reflectively load and execute shellcode via CreateThread/WaitForSingleObject entirely in memory, using the Windows Fiber API for additional evasion. No disk artifacts are created in this chain. Obfuscation throughout both chains includes randomized variable names, arithmetic no-op insertion, dead loops, and misleading control flow.
Once resident, the final-stage payload targets Chrome/Edge Login Data and Web Data SQLite databases, DPAPI-encrypted passwords and cookies, session/authentication tokens (enabling session hijacking and MFA bypass via token reuse), PDFs and Office documents from Desktop/Downloads, and — notably for enterprise victims — Microsoft 365 documents and OneDrive/SharePoint-synced folders, before staging and exfiltrating the collected data.
No CVE is exploited in either chain; both rely entirely on social engineering (ClickFix) and inherited user privileges, making application control (blocking PowerShell/Python/mshta.exe/rundll32.exe execution from internet-delivered content), attack-surface-reduction rules, and user education the primary mitigations rather than patching.
MITRE ATT&CK techniques used in TL-2026-1444
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Steganography; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Clear Command History; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Privilege Escalation
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1106 Native API; T1129 Shared Modules
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Discovery
T1083 File and Directory Discovery
Initial Access
execution
T1204.004 Malicious Copy and Paste
stealth
T1218.005 Mshta; T1218.011 Rundll32
Impact
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
defense-impairment
Affected products and versions in ACR Stealer (Amatera Stealer) Uses ClickFix Lures
- Microsoft — Windows (all supported client/server versions with browser and Microsoft 365 usage)
Vulnerable versions: Windows 10; Windows 11; Windows Server (user-execution context) - Google — Chrome (stored credential/session-cookie database)
Vulnerable versions: All versions storing DPAPI-protected Login Data/Web Data - Microsoft — Edge / Microsoft 365 / OneDrive / SharePoint (synced data, browser-stored credentials)
Vulnerable versions: All versions with local sync or saved-credential storage
Remediation for ACR Stealer (Amatera Stealer) Uses ClickFix Lures
Immediate actions
- Block or restrict outbound access to observed ACR Stealer/ClickFix domains at web/DNS filtering layer
- Deploy application control to prevent mshta.exe, rundll32.exe, powershell.exe, and pythonw.exe from executing content delivered from the internet or user-writable directories
- Block or restrict outbound WebDAV (HTTP/HTTPS to WebClient) connections to unmanaged/external shares
- Enable Attack Surface Reduction (ASR) rules covering %LocalAppData%\Temp, Downloads, and other user-writable execution paths
- Search Registry RunMRU keys for GUID-based WebDAV paths and @SSL patterns indicative of ClickFix execution
- Hunt for scheduled tasks masquerading as software-update tasks created outside normal patch cadence
Workarounds
- Disable or restrict the Windows Run dialog / Win+R via GPO for high-risk user populations
- Block execution of the WebClient (WebDAV) service where not business-required
Longer-term hardening
- Deploy EDR with behavioral detection in block mode plus automated investigation and remediation
- Enforce PowerShell Constrained Language Mode, script block logging, module logging, and transcription
- Reduce reliance on browser-stored credentials in favor of an enterprise password manager / FIDO2
- Enforce MFA and conditional access for all Microsoft 365/OneDrive/SharePoint access
- User-awareness training specifically covering ClickFix 'paste-and-run' social engineering and fake AI-tool download pages
Weaknesses (CWE) in ACR Stealer (Amatera Stealer) Uses ClickFix Lures
CWE-506, CWE-494
Timeline of ACR Stealer (Amatera Stealer) Uses ClickFix Lures
- ACR Stealer (AcridRain) in active circulation as a commodity malware-as-a-service offering on Russian-speaking cybercrime forums, operated by actor 'SheldIO'.
- SheldIO announces shutdown of the ACR Stealer marketplace operation; eSentire reports the source code was sold while Proofpoint assesses the operator continued via a private Telegram channel.
- ClearFake web-inject cluster begins feeding ACR Stealer payloads via fake browser-update lures on compromised websites, later adopting EtherHiding for C2 resolution.
- ACR Stealer is rebranded as Amatera Stealer, sold as a subscription MaaS priced $199-$1,499/year.
- Microsoft discloses a DNS-based ClickFix attack using nslookup for malware staging, part of the broader ClickFix technique escalation.
- Microsoft reveals a ClickFix campaign abusing Windows Terminal to deploy Lumma Stealer, indicating continued threat-actor investment in the ClickFix technique.
- Red Canary telemetry ranks ClearFake as the #1 most prevalent threat observed in April 2026; Claude-branded ClickFix lures first detected in this window.
- Microsoft Defender Experts begin observing an increase in ACR Stealer activity delivered via ClickFix lures across customer environments (window: late April-mid June 2026).
- A related campaign abuses over 92 unique GitLab Pages (*.gitlab.io) hostnames impersonating AI developer tools, including fake claude-desktop pages, funneling 2,000+ victims from sponsored Google search ads; the claude.ai shared-chat feature itself is abused as a delivery/legitimacy layer.
- Microsoft documents a related ClickFix campaign using fake macOS utility lures to deliver infostealers, showing cross-platform targeting logic (Mac vs Windows instructions served by user agent).
- SANS ISC handler Brad Duncan documents a Windows infection chain triggered via a fake Claude-impersonator ClickFix page.
- Close of the late April-mid June 2026 window during which Microsoft Defender Experts tracked escalating ACR Stealer/ClickFix activity.
- Microsoft Security Blog publishes 'ACR Stealer: Two observed intrusion chains amid increased threat activity,' detailing the WebDAV/EtherHiding and fileless/steganographic chains with IOCs and hunting queries.
- The Hacker News reports on the ACR Stealer ClickFix/EtherHiding campaigns, surfacing the threat for broader defender awareness.
Sources cited for ACR Stealer (Amatera Stealer) Uses ClickFix Lures
- ACR Stealer Uses ClickFix Lures to Deploy Fileless and Disk-Based Infection Chains
- ACR Stealer: Two observed intrusion chains amid increased threat activity
- Intelligence Insights: May 2026
- ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA
- Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- Attackers abuse Google Ads, GitLab, and Claude to deliver malware
- Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign
- ClearFake's New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
- ClearFake Abuses BSC Testnet Contracts for Resilient C2 Operations
- "EtherHiding" — Hiding Web2 Malicious Code in Web3 Smart Contracts
- New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware
- Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer
- Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging
Threats related to ACR Stealer (Amatera Stealer) Uses ClickFix Lures
- Hundreds of WordPress Sites Hijacked via Malicious Plugins to Deploy Amatera Stealer through EtherHiding and ClickFix
- Armored Likho APT Deploys BusySnake Python Stealer with PyArmor Obfuscation Against Government and Power Infrastructure Targets
- Fake Game Downloads Deliver Amatera Stealer via Ren'Py Loader, MSBuild Abuse, and EtherHiding C2
- ACR Stealer Delivered via Fake Claude Download Page (fairpoint29[.]com) — Google Ads SEO Poisoning Targeting Windows
- Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channel
- UAT-11795 Deploys Novel Starland RAT and Bespoke WLDR C2 Implant in Financially Motivated Campaign
Detection coverage for TL-2026-1444
As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1444 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.