# ACR Stealer Campaign Targets Microsoft Enterprise Credentials

> Microsoft warns of a surge in ACR Stealer attacks targeting browser credentials and session tokens to bypass multi-factor authentication in enterprise environments.

- Published: 2026-07-18T16:59:16.000Z
- Severity: high
- Category: Malware
- Tags: ACR Stealer, Infostealer, Microsoft, Credential Theft
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/microsoft-warns-of-surge-in-acr-stealer-attacks-on-customers/
- Canonical: https://runtimerebel.com/blog/acr-stealer-campaign-targets-microsoft-enterprise-credentials

## Key points

- ACR Stealer targets enterprise credentials and tokens to bypass multi-factor authentication and gain unauthorized access to cloud environments.
- Affected systems include Windows workstations running Chromium-based browsers, FTP clients, and messaging applications like Telegram or Discord.
- Organizations should implement phishing-resistant authentication and limit session lifetimes to invalidate stolen browser cookies and authentication tokens.

Microsoft has issued a security warning regarding a significant increase in ACR Stealer activity targeting its enterprise customers. According to [Bleeping Computer](https://www.bleepingcomputer.com/news/security/microsoft-warns-of-surge-in-acr-stealer-attacks-on-customers/), this information-stealing malware is being utilized to harvest a wide range of sensitive data, including browser-stored passwords, authentication tokens, and session cookies. By obtaining these session tokens, attackers can perform session hijacking, which allows them to bypass multi-factor authentication (MFA) requirements and gain direct access to corporate cloud resources.

## Technical Analysis: ACR Stealer Credential Theft Prevention

ACR Stealer is a sophisticated C/C++ based malware that focuses on the extraction of data from local storage. It specifically targets the SQLite databases used by Chromium-based browsers, such as Microsoft Edge and Google Chrome, to store user credentials and cookies. Unlike simpler stealers, ACR Stealer is designed to identify and exfiltrate data from a variety of sources, including VPN configurations, FTP clients, and cryptocurrency wallets. This makes it a primary tool for initial access brokers who sell harvested credentials to other threat actors for follow-on activities like [Ransomware](/glossary#ransomware) or data extortion.

Once the malware is executed, it communicates with an attacker-controlled [C2](/glossary#c2) server to upload the stolen data. The malware is often delivered via [Phishing](/glossary#phishing) campaigns or bundled with illegitimate software downloads, such as cracked applications or pirated productivity tools. Because it frequently resides in memory or uses obfuscation techniques to hide its payload, detecting the infection requires advanced monitoring capabilities.

When security teams investigate how to detect ACR Stealer malware infections, they should focus on identifying abnormal process behavior. The [SOC](/glossary#soc) should monitor for unauthorized processes attempting to read browser profile directories or unusual outbound network connections to non-standard IP ranges. Analyzing [IoC](/glossary#ioc) data from recent campaigns shows that the malware often uses unique file naming conventions and specific registry keys to maintain its presence on the host.

### Alignment with MITRE ATT&CK

The operations of ACR Stealer align with several techniques categorized in the [MITRE ATT&CK](/glossary#mitre-att-ck) framework, including:

*   **T1539 (Steal Web Session Cookie):** Directly harvesting cookies to bypass MFA.
*   **T1555 (Credentials from Web Browsers):** Extracting saved passwords from local browser storage.
*   **T1041 (Exfiltration Over C2 Channel):** Sending stolen data to external infrastructure.

## Strategic Recommendations for Defenders

Understanding how to mitigate ACR Stealer attacks requires a defense-in-depth approach that moves beyond traditional antivirus. Organizations should prioritize the implementation of [EDR](/glossary#edr) solutions to provide visibility into the execution of unknown binaries. Furthermore, moving toward [Zero Trust](/glossary#zero-trust) principles can significantly limit the blast radius if a single machine is compromised.

To strengthen ACR Stealer credential theft prevention, defenders should implement the following mitigations:

1.  **Phishing-Resistant Authentication:** Use FIDO2-compliant hardware security keys which are not susceptible to token theft.
2.  **Session Lifetime Management:** Enforce strict session timeouts for all critical enterprise applications to ensure that stolen cookies have a limited window of utility.
3.  **Application Control:** Block the execution of unsigned or unapproved software, especially in environments where users may attempt to download 'cracked' software.
4.  **Credential Isolation:** Migrate users away from browser-based password management toward managed enterprise password vaults that do not store secrets in predictable local directories.

By focusing on these proactive measures, organizations can better protect their identities and sensitive data from the increasing threat of modern information stealers.

**Related:** [ACR Stealer Distributed via Fake Claude AI Desktop Site](/blog/acr-stealer-distributed-via-fake-claude-ai-desktop-site), [OkoBot Framework: Multi-Payload Data & Crypto Theft Attacks](/blog/okobot-framework-multi-payload-data-crypto-theft-attacks)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/acr-stealer-campaign-targets-microsoft-enterprise-credentials