ACR Stealer: Two observed intrusion chains amid increased threat activity

From late April to mid-June 2026 Microsoft Defender Experts observed an uptick in ACR Stealer campaigns targeting enterprise environments. Attackers used ClickFix-themed lures to deliver malware and browser-focused stealers that exfiltrate browser-stored credentials, authentication tokens, and sensitive documents. Microsoft documented two distinct intrusion chains leveraging social-engineered lures, token harvesting, and credential theft to gain access and move data out of compromised environments.