The malware operators used ClickFix social engineering, WebDAV servers, and Microsoft HTML Application Host utilities to deliver the payload to the target systems.
Microsoft notes that ACR Stealer is a malware-as-a-service (MaaS) that likely represents repackaged Amatera Stealer. It is a remote-access tool that steals credentials and sensitive data from the target systems and uses various methods to avoid detection.
Microsoft reported that there are two main attack chains that the attackers used to distribute ACR Stealer.
The first one began with a ClickFix lure诱导 users to run a command that triggered a remote WebDAV server. Specifically, the malicious command used rundll32.exe, a legitimate Windows process, to execute a DLL file located on the remote server. The attackers used WebDAV to host the payload because the file system structure of the server was similar to the standard Windows file system, which helped the malicious traffic to blend in with network traffic.
After establishing a connection to the command-and-control (C2) server, the attackers delivered an obfuscated PowerShell script that initiated the malware installation process. It downloaded the malware payload as a Python loader, installed scheduled tasks to maintain persistence, and attempted to clear the event logs, PowerShell history, and other tracking mechanisms. The malware also used process injection to execute itself in memory, evading detection by security software.
Some ACR Stealer variants used blockchain-based dead-drop resolvers to receive updates or C2 addresses.
In this technique, the attackers used publicly accessible blockchain addresses to store encryption keys and other data needed to retrieve the payload, also known as EtherHiding.
The second attack chain also began with a ClickFix lure but used MSHTA to execute the payload. In this method, the attackers tricked the users into launching a Microsoft HTML Application that delivered an obfuscated PowerShell downloader to the target system. The downloader then retrieved an encrypted payload from a public steganographic JPEG image and executed it in memory.
In both attack chains, the malware maintained persistence by installing scheduled tasks, encrypting and decrypting browser credentials using Windows Data Protection API (DPAPI), and injecting itself into processes. It also stole browser data, including cookies, tokens, and passwords, by targeting the Chromium database used by Google Chrome and Microsoft Edge browsers.
Additionally, the malware scanned the target system for PDF files, Microsoft 365 documents, and files stored in the Desktop, Downloads, and other folders and enterprise file-sharing platforms such as OneDrive and SharePoint.
Microsoft notes that the observed attacks only represent a subset of the initial ACR Stealer delivery methods. The tech giant added that the malware operators could use various other attack chains to compromise enterprise systems.
Microsoft advises users never to copy commands from websites that claim to repair errors or confirm their human identity, as attackers often use such websites to deliver malware. It also recommends that organizations limit user access to unnecessary online resources and deny access to domains associated with new and suspicious websites.
The company also advises organizations to use application control policies to block PowerShell, Python, MSHTA, rundll32.exe, and other utilities from running obfuscated scripts or downloading content from remote or user-controlled sites.
Microsoft also published a list of mitigation measures and indicators of compromise (IOCs) that can help organizations detect ACR Stealer attacks.
