ACR Stealer Endangers Corporate Networks

The ACR Stealer, an infostealer that has been circulating since 2024, has proven to be a serious threat to corporate networks. It is capable of stealing stored browser passwords, live session tokens, as well as documents from Microsoft 365 and files from synchronized OneDrive and SharePoint folders. The malware infiltrates systems when users enter a specific command into the Run field and confirm it.

Attack Vectors and Distribution

Microsoft recently disclosed two of the supply chains of the ACR Stealers. This information comes from the company's Defender experts who analyzed the attack vectors. The malware employs various methods to penetrate networks, with entering a simple command into the Run field being one of the most common. This technique does not require any special technical knowledge, increasing the danger for companies.

The distribution of the ACR Stealers often occurs through phishing attacks or by exploiting vulnerabilities in software. Once the malware infiltrates a system, it immediately begins collecting sensitive data. This includes not only passwords but also documents that are critical for daily operations in companies.

Consequences for Companies

The impact of a successful attack by the ACR Stealer can be severe for companies. The loss of credentials and sensitive documents can lead not only to financial losses but also jeopardize the trust of customers and partners. Companies must be aware of the risks and take appropriate measures to protect their networks.

Microsoft has emphasized that educating employees about the dangers of phishing and unsafe commands is crucial to preventing such attacks. Training and regular security reviews can help reduce the likelihood of a successful attack. Raising awareness of the dangers posed by malware like the ACR Stealer is an important step in a company's cybersecurity strategy.

The Defender experts at Microsoft are continuously working to identify new threats and inform companies about the latest developments in cybersecurity. Their analyses and reports are crucial in helping companies prepare against attacks and protect their data. The threat posed by the ACR Stealer remains high, and companies are called upon to take proactive measures.