New ACR Stealer campaigns use WebDAV, MSHTA to evade detection

Microsoft has issued a warning about a recent surge in ACR Stealer activity that uses ClickFix-style social engineering to steal credentials, browser data, and sensitive business documents. In a new report, Microsoft researchers detailed two separate campaigns observed between late April and mid-June 2026 that use different execution techniques for the same theft. The campaign was seen tricking users into executing malicious commands to resolve a fake issue.