# ACR Stealer (Amatera Stealer) Uses ClickFix Lures, WebDAV/pushd DLL Delivery, and EtherHiding to Harvest Browser and Microsoft 365 Data

> ACR Stealer (formerly AcridRain, rebranded Amatera Stealer in June 2025) is being distributed via ClickFix social-engineering lures — including fake Claude AI / claude-desktop GitLab Pages sites — that trick users into pasting commands into the Windows Run dialog. Microsoft tracked two distinct intrusion chains between late April and mid-June 2026: a WebDAV/pushd/rundll32 disk-based chain using Python loaders and blockchain-backed (EtherHiding) dead-drop C2 resolution, and a fully fileless mshta/HTA/VBScript chain that hides its payload inside JPEG pixels hosted on ImgBB and executes it entirely in memory. The malware harvests browser credentials, session cookies, DPAPI secrets, and Microsoft 365/OneDrive/SharePoint documents.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1444
- **ID:** TL-2026-1444
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SheldIO
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ACR Stealer is a commodity information-stealer first tracked as AcridRain and rebranded Amatera Stealer in June 2025 following an alleged marketplace shutdown by its operator, 'SheldIO', on Russian-speaking cybercrime forums in July 2024. eSentire has reported the source code was sold; Proofpoint assesses the original operator likely continued operations via a private Telegram channel, and the malware is also assessed by some researchers as an evolution of GrMsk Stealer. Amatera/ACR is sold as a subscription malware-as-a-service offering priced between $199 and $1,499 per year.

Between late April 2026 and mid-June 2026, Microsoft Defender Experts observed a marked increase in ACR Stealer activity delivered via the ClickFix social-engineering technique, in which victims are lured (via malicious Google Ads, compromised sites, or fake pages impersonating legitimate software such as Claude AI/Claude Code hosted on GitLab Pages under the trusted *.gitlab.io domain) into copying and pasting an attacker-supplied command into the Windows Run dialog, PowerShell, or Terminal. A related campaign observed by SANS ISC and Trend Micro abused over 92 unique GitLab Pages hostnames and the claude.ai shared-chat feature itself as a delivery/legitimacy layer, funneling more than 2,000 victims from sponsored search ads.

Microsoft documented two divergent post-ClickFix intrusion chains feeding the same ACR Stealer/Amatera payload family:

Campaign 1 (WebDAV/disk-based): The pasted command invokes cmd.exe, which uses rundll32.exe (or, in some variants, pushd to mount the remote share as a local drive letter) to load a DLL staged on a WebDAV share reachable over HTTPS at GUID-keyed paths (e.g. \\sphere-api.dialectosphere.in[.]net\05fe317c-0981-4de2-bc8a-930d369db441\ck-3d80df5d12cdfe6450a782fc87bf66b444.google). The stealthiest observed variant wraps execution in conhost.exe --headless with delayed environment-variable expansion for obfuscation. The DLL triggers an obfuscated PowerShell stage that drops a ZIP archive to %LocalAppData%\Temp under an innocuous directory name (e.g. LogiOptionsPlus), containing a bundled pythonw.exe runtime that silently launches a Python loader. Persistence is established via a hidden scheduled task disguised as a routine software-update task; the malware then copies file timestamps from notepad.exe (timestomping) and clears PowerShell history to hinder forensics. A subset of these intrusions use a secondary Python loader implementing EtherHiding — querying public blockchain RPC endpoints and third-party Web3 node infrastructure to resolve a dead-drop C2 address or follow-up payload stored on a public ledger (a technique pioneered by the ClearFake web-inject cluster, which has fed ACR Stealer since at least March 2025 and which Red Canary ranked the #1 most prevalent threat in its telemetry for April 2026).

Campaign 2 (fileless/steganographic): The pasted command spawns mshta.exe, which fetches a remote HTA payload from an attacker-controlled domain. An embedded VBScript loader uses COM objects to decode and launch PowerShell, which mints a victim-specific identifier, disables TLS/certificate validation, and downloads a JPEG image (hosted on ImgBB in observed samples) containing an encrypted payload hidden in the pixel data. Custom PowerShell routines extract, decrypt, and decompress the payload, then resolve Win32 APIs at runtime (LoadLibrary, GetProcAddress, VirtualAlloc) to reflectively load and execute shellcode via CreateThread/WaitForSingleObject entirely in memory, using the Windows Fiber API for additional evasion. No disk artifacts are created in this chain. Obfuscation throughout both chains includes randomized variable names, arithmetic no-op insertion, dead loops, and misleading control flow.

Once resident, the final-stage payload targets Chrome/Edge Login Data and Web Data SQLite databases, DPAPI-encrypted passwords and cookies, session/authentication tokens (enabling session hijacking and MFA bypass via token reuse), PDFs and Office documents from Desktop/Downloads, and — notably for enterprise victims — Microsoft 365 documents and OneDrive/SharePoint-synced folders, before staging and exfiltrating the collected data.

No CVE is exploited in either chain; both rely entirely on social engineering (ClickFix) and inherited user privileges, making application control (blocking PowerShell/Python/mshta.exe/rundll32.exe execution from internet-delivered content), attack-surface-reduction rules, and user education the primary mitigations rather than patching.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.003 Windows Command Shell
- T1218.011 Rundll32
- T1218.005 Mshta
- T1106 Native API
- T1129 Shared Modules
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1070.006 Timestomp
- T1070.003 Clear Command History
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560 Archive Collected Data
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [ACR Stealer Uses ClickFix Lures to Deploy Fileless and Disk-Based Infection Chains](https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html)
- [ACR Stealer: Two observed intrusion chains amid increased threat activity](https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/)
- [Intelligence Insights: May 2026](https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2026/)
- [ClickFix Campaign Uses EtherHiding and GULoader to Infect Windows Users via Fake CAPTCHA](https://cybersecuritynews.com/clickfix-campaign-uses-etherhiding-and-guloader/)
- [Dissecting a Live ClickFix Attack: EtherHiding, WebDAV Abuse, and How ASR Saves the Day](https://www.lindensec.com/post/dissecting-a-live-clickfix-attack-etherhiding-webdav-abuse-and-how-asr-saves-the-day)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [Attackers abuse Google Ads, GitLab, and Claude to deliver malware](https://www.csoonline.com/article/4186813/attackers-abuse-google-ads-gitlab-and-claude-to-deliver-malware.html)
- [Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign](https://www.trendmicro.com/en/research/26/f/claudeai-shared-chat-abused-in-malvertising.html)
- [ClearFake's New Widespread Variant: Increased Web3 Exploitation for Malware Delivery](https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/)
- [ClearFake Abuses BSC Testnet Contracts for Resilient C2 Operations](https://gbhackers.com/clearfake-abuses-bsc-testnet/)
- ["EtherHiding" — Hiding Web2 Malicious Code in Web3 Smart Contracts](https://guard.io/labs/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts)
- [New Group on the Block: UNC5142 Leverages EtherHiding to Distribute Malware](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware)
- [Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer](https://thehackernews.com/2026/03/microsoft-reveals-clickfix-campaign.html)
- [Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging](https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1444