Could an employee accidentally give an attacker access to your company without downloading an obvious malicious file?
That is exactly what a new ACR Stealer campaign is designed to accomplish. The attack does not require an unpatched vulnerability. It relies on convincing someone to run what appears to be a legitimate command, then uses trusted Windows capabilities to carry out the theft.
According to CSO Online, Microsoft observed two ACR Stealer campaigns between late April and mid-June 2026.
Both began with a ClickFix lure. The victim sees a fake technical problem, CAPTCHA failure, or browser error and is instructed to copy and execute a command to resolve it.
That command starts the infection.
One campaign used WebDAV-hosted files, PowerShell, Python loaders, scheduled tasks, and blockchain-based infrastructure. The other relied on MSHTA, obfuscated PowerShell, steganography, and primarily fileless execution in memory.
Although the attack paths looked different, the objective was the same: steal browser credentials, session tokens, and sensitive business documents.
A password is no longer the only key to a business account.
Session tokens allow websites and cloud applications to remember that a user has already authenticated. If an attacker steals a valid token, the attacker may be able to impersonate that employee and enter email, cloud storage, financial platforms, or business applications without repeating the normal login process.
This can allow an attacker to:
The risk can remain even when the organization uses multifactor authentication because the attacker may be stealing an authenticated session rather than attempting a new login.
These campaigns demonstrate why “Detect and Respond” is no longer enough by itself.
The attackers are not relying entirely on an unfamiliar malicious executable. They are abusing legitimate Windows capabilities such as MSHTA, PowerShell, scheduled tasks, and WebDAV. This is commonly called a living-off-the-land attack.
Red Canary’s threat research explains that MSHTA is attractive to attackers because it can execute arbitrary code through a trusted, signed Windows utility. CISA and its partners have also warned that living-off-the-land techniques allow attackers to blend malicious behavior with normal system activity.
Attackers can also vary their delivery methods, tamper with security controls, obscure PowerShell commands, and execute payloads in memory. Those changes may cause related incidents to appear unrelated, delaying investigation while credentials and data are being stolen.
Credential theft is not a minor technical incident. It can become a business-wide disruption.
IBM reports that the global average cost of a data breach reached $4.44 million in 2025, while the average cost in the United States reached $10.22 million. IBM also found that organizations still took an average of 241 days to identify and contain a breach.
The Verizon 2025 Data Breach Investigations Report found that compromised credentials were an initial access vector in 22% of the breaches it reviewed.
For a business, the consequences can include operational downtime, incident-response expenses, lost productivity, fraudulent transactions, regulatory investigations, legal exposure, and damaged customer trust.
Organizations should assume that users can be deceived and detection tools can be bypassed.
Isolation and Containment focuses on preventing unauthorized activity before damage occurs. Instead of waiting for a security product to recognize the attacker, this model restricts what applications and trusted Windows processes are allowed to do.
That means an unauthorized command may run into boundaries that prevent it from accessing protected memory, stealing credentials, modifying critical files, establishing persistence, or encrypting business data.
AppGuard is a proven endpoint protection solution with more than 12 years in production, focused on prevention through Isolation and Containment. It works alongside antivirus, EDR, and MDR by reducing the execution freedom attackers depend on.
The objective is not merely to detect the intrusion faster. It is to prevent the intrusion from creating business impact.
Assume that detection will occasionally fail and build your security strategy around that reality.
Add prevention layers that restrict unauthorized application behavior. Reduce unnecessary use of PowerShell, MSHTA, scripting tools, and other capabilities employees do not require. Review third-party and privileged access. Protect browser credential stores and cloud sessions. Segment critical systems so one compromised endpoint cannot expose the entire organization.
Leadership teams should also test scenarios involving stolen session tokens, compromised email accounts, disabled security tools, and fileless malware. Confirm that incident-response plans address cloud identity compromise, not only ransomware encryption.
Most importantly, measure security by the damage an attacker can cause after gaining initial access, not simply by the number of alerts generated.
Business owners who want to better understand how prevention-first security can stop attacks before damage occurs should review our July 28th podcast and schedule time talk with CHIPS about how AppGuard can help prevent incidents like this through Isolation and Containment.