TW / Independent
← Research audits

Malware Analysis / Evidence: no local binary artefact

ACR Stealer: two delivery chains, one data-theft objective

Source-bound reconstruction of two attack chains observed in 2026: ClickFix, WebDAV, Python persistence, MSHTA, steganography and browser-data theft.

Scope
Two ACR Stealer campaigns observed by Microsoft Defender Experts from late April to mid-June 2026.
Method
Static source and architecture review; no malware obtained, built or executed.
Evidence
No local sample and no reliably attributable SHA-256 in the cited report.
Finding

The divergence after the common ClickFix entry point and its telemetry points are documented in detail.

No independent sample, runtime, C2 or campaign verification.

Analyst note

What the evidence actually supports.

This is a comparison of two observed delivery chains, not a simulated first-hand sample analysis. The original contribution is the telemetry crosswalk and its explicit detection boundaries.

Evidence anchoropen evidence gap
Artefact
Kein Binärartefakt im Prüfbestand
SHA-256
not available
Analysis basis
No local sample and no reliably attributable SHA-256 in the cited report.
Malware / Evidence Atlas

Campaign entry → Exfiltration

The analysis path for this report. Every node shows what is supported, where detection can start and where the claim stops.

5flow nodes 2detection artefacts 2rule formats
Claim

Campaign entry

The report separates documented delivery chains from the stealer itself.

Detection focus

Capture referrer, archive and launch process as a chain.

Bound to primary research
Config Surface

Configuration fingerprint

Review pivots derived from the report — not a live configuration or universal family indicator.

01
Delivery branchClickFix / WebDAV
core
02
StagingMSHTA / Python
core
03
Persistencebranch-bound
support
04
Browser targetprofile stores
support
MODEL / 8BFD58FACore, support and boundary — not risk scores
Detection Pack

Defensive artefacts

Source, validation and limits accompany every rule.

SourceOriginal derivation from the reported behaviour chain.ValidationParsed by pySigma; synthetic truth table 3/3.LimitDetects the documented MSHTA delivery chain, not the stealer core.
SigmaOpen rule
Defensive model
title: ACR chain-B MSHTA handoff candidate
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\\mshta.exe'
    CommandLine|contains: 'http'
    ParentImage|endswith: '\\powershell.exe'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium

Evidence status Supported by review evidenceBound to primary researchBounded or unresolved

Scope, snapshot and evidence boundary

Two ACR Stealer campaigns observed by Microsoft Defender Experts from late April to mid-June 2026. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?

What is supported — and what is missing

Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.

FILE / EVIDENCE MAP

Evidence chain and open runtime gap

The map separates primary source, reproducible source snapshots and runtime evidence not collected here.

A file reference does not establish runtime behaviour. Recorded processing is not a new execution.

SourceToolDerivedEvidenceMissingVerified referenceRecordedUnresolved

Evidence

Traceable source with an explicit sample gap.

Primary source

Published analysis or pinned upstream snapshot.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

Related report section →
Documented observations

Sample, sandbox or telemetry claims made by the source.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →
No local malware sample

No first-party runtime, C2 or campaign telemetry.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →

Limit: A published observation is not an independent reproduction.

Entry and delivery chain

Both observed chains start with ClickFix: the victim runs an attacker-supplied command. Chain A uses rundll32 to load a DLL from an HTTPS WebDAV share, then obfuscated PowerShell and a bundled Python interpreter. Chain B pivots through PowerShell to MSHTA, a remote HTA and in-memory execution.

Architecture and data flow

Chain A installs a ZIP package under a deceptively named LocalAppData path, starts pythonw without a console and can resolve C2 destinations through a blockchain dead-drop reference. Chain B carries an encrypted payload in JPEG data and loads it reflectively. The shared element is the stealer objective, not the loader construction.

Analysis resistance and persistence

Arithmetic no-ops, dead loops, randomized variables, headless conhost, timestamp changes and cleared command history frustrate single-artifact detection. These techniques are not unique to ACR; their temporal relationship with WebDAV, MSHTA or browser access creates the stronger signal.

Capabilities, objective and impact

The documented objective is browser passwords, session tokens, authentication artifacts and sensitive documents. A stealer finding therefore establishes risk to follow-on account and cloud access, but not proof that such access occurred.

Telemetry plan and evidence chain

Detection should model the shared human entry point and both technical branches: Explorer or Run dialog to cmd/PowerShell, rundll32 with WebDAV, pythonw from user-writable paths, MSHTA with a remote URL and subsequent access to browser data. Individual LOLBins remain too broad. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.

Detection engineering and countertesting

Detection should model the shared human entry point and both technical branches: Explorer or Run dialog to cmd/PowerShell, rundll32 with WebDAV, pythonw from user-writable paths, MSHTA with a remote URL and subsequent access to browser data. Individual LOLBins remain too broad. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.

yamlDefensive model, not engine-validatedDefensive model
title: ACR chain-B MSHTA handoff candidate
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\\mshta.exe'
    CommandLine|contains: 'http'
    ParentImage|endswith: '\\powershell.exe'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium
Read the code

Alternative hypotheses and negative tests

Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. Microsoft explicitly describes the two chains as representative, not exhaustive. Attribution relies on behaviour plus OSINT corroboration; WebDAV, blockchain or MSHTA use alone is not proof of the family. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.

Attribution and variant risk

Microsoft explicitly describes the two chains as representative, not exhaustive. Attribution relies on behaviour plus OSINT corroboration; WebDAV, blockchain or MSHTA use alone is not proof of the family.

Final assessment

The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.

Findings at a glance

  • The shared ClickFix entry branches into a file-backed WebDAV/Python chain and an in-memory MSHTA/JPEG chain.
  • Persistence and evasion differ; browser-data theft is the shared objective.
  • Correlation across process, file, network and browser telemetry is stronger than one LOLBin rule.

Review limits

  • No independent sample, runtime, C2 or campaign verification.
  • Microsoft explicitly describes the two chains as representative, not exhaustive. Attribution relies on behaviour plus OSINT corroboration; WebDAV, blockchain or MSHTA use alone is not proof of the family.
  • Defensive models were not validated with a target engine.

Context, not evidence

The Evidence Anchor at the start identifies the binary, file or revision actually used. These links provide context and reported observations; they do not substitute for local sample analysis.

Microsoft Security Research — ACR Stealer intrusion chains ↗
Final assessment

Conclusion

Conclusion: structure before signature

The greatest defensive value comes from connecting entry, internal architecture, persistence, impact and telemetry. Individual names, hashes or IOCs remain supporting evidence, not the conclusion.

Next steps

  • Test models against synthetic positives and legitimate negatives.
  • Rebind version and evidence snapshot with every update.
  • Extend runtime claims only after first-party, lawfully available telemetry.
Basis of this judgmentHigh for directly inspectable structure; limited for runtime and campaign claims not independently reproduced.
Two ACR Stealer campaigns observed by Microsoft Defender Experts from late April to mid-June 2026.
← All research audits

Start a conversation

Discuss your project.

Start a conversation