security: ACR Stealer: Two observed intrusion chains amid increased threat activity
Microsoft Security Blog
2026-07-16
Microsoft Defender Experts observed increased ACR Stealer activity from late April to mid-June 2026 across customer environments. The campaigns used ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.