ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

ACR Stealer an infostealer in circulation since 2024 is walking out of enterprise networks with saved browser passwords live session tokens PDFs Microsoft 365 documents and files from synced OneDrive and SharePoint folders It gets in because someone pasted a command into a Run box and pressed Enter Microsoft laid out two of the delivery chains on Thursday Its Defender Experts team the