ACR Stealer & ClickFix: Detecting Browser Token Theft and M365 Data Exfiltration

---
title: Potential ClickFix Activity via PowerShell Run Box
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious PowerShell execution spawned by explorer.exe (Run box parent) containing download indicators common in ClickFix campaigns.
references:
 - https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html
author: Security Arsenal
date: 2026/07/17
tags:
 - attack.execution
 - attack.t1059.001
 - attack.initial_access
 - attack.t1190
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith: '\explorer.exe'
   Image|endswith:
     - '\powershell.exe'
     - '\cmd.exe'
   CommandLine|contains:
     - 'DownloadString'
     - 'IEX '
     - 'Invoke-Expression'
   CommandLine|contains:
     - 'http://'
     - 'https://'
 condition: selection
falsepositives:
 - Legitimate administrative troubleshooting (rare)
level: high
---
title: ACR Stealer Browser Credential Access
id: 9b3c2d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects non-browser processes accessing browser credential databases (Login Data), a common behavior of ACR Stealer and similar infostealers.
references:
 - https://thehackernews.com/2026/07/acr-stealer-uses-clickfix-lures-to.html
author: Security Arsenal
date: 2026/07/17
tags:
 - attack.credential_access
 - attack.t1555.003
logsource:
 category: file_access
 product: windows
detection:
 selection:
   TargetFilename|contains:
     - '\Google\Chrome\User Data\Default\Login Data'
     - '\Google\Chrome\User Data\Default\Cookies'
     - '\Microsoft\Edge\User Data\Default\Login Data'
 filter_legit_browsers:
   Image|contains:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\brave.exe'
 condition: selection and not filter_legit_browsers
falsepositives:
 - Backup software or security scanners accessing browser data
level: high

let SuspiciousCommands = dynamic(['DownloadString', 'IEX', 'Invoke-Expression', 'FromBase64String']);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "explorer.exe"
| where ProcessFileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe")
| where ProcessCommandLine has_any (SuspiciousCommands) and (ProcessCommandLine has "http" or ProcessCommandLine has "https")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, ProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort
) on DeviceName, Timestamp
| where TimeGenerated between (ago(1m) .. now()) // Approximate correlation window
| summarize arg_max(Timestamp, *) by DeviceName, ProcessCommandLine

-- Hunt for ACR Stealer Indicators
SELECT
    format(format="%H:%M:%S", timestamp=Sys.EventTime) as EventTime,
    Sys.Username as User,
    Process.Name as ProcessName,
    Process.Cmdline as CommandLine,
    File.FullPath as TargetFile,
    File.Size as FileSize
FROM watch_process_file_operations(throttle=1000)
WHERE
    -- Targeting Browser Secrets
    TargetFile =~ "Login Data" OR TargetFile =~ "Cookies"
    -- Excluding legitimate browser processes
    AND Name NOT =~ "chrome.exe" AND Name NOT =~ "msedge.exe" AND Name NOT =~ "firefox.exe"
    -- OR Targeting M365 Sync Folders
    OR (TargetFile =~ "OneDrive" AND (TargetFile =~ ".docx" OR TargetFile =~ ".pdf"))
    OR (TargetFile =~ "SharePoint" AND (TargetFile =~ ".docx" OR TargetFile =~ ".pdf"))
LIMIT 100

# ACR Stealer Remediation & Hunting Script
# Requires Admin Privileges

Write-Host "[*] Starting hunt for ACR Stealer indicators..." -ForegroundColor Cyan

# 1. Identify Suspicious Run Keys (Common persistence for stealers)
$suspiciousPaths = @("$env:TEMP", "$env:APPDATA")
$runKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item $key | ForEach-Object {
            $_.Property | ForEach-Object {
                $value = (Get-ItemProperty -Path "$key\$_")."$_"
                foreach ($path in $suspiciousPaths) {
                    if ($value -like "*$path*") {
                        Write-Host "[!] Suspicious Run Key found: $key\$_ -> $value" -ForegroundColor Red
                        # Uncomment to remove automatically:
                        # Remove-ItemProperty -Path $key -Name $_ -Force
                    }
                }
            }
        }
    }
}

# 2. Kill Suspicious Processes (ClickFix Pattern)
# Note: Verify these processes before killing in production
Write-Host "[*] Checking for suspicious PowerShell processes..." -ForegroundColor Cyan
$processes = Get-WmiObject Win32_Process | Where-Object {
    $_.Name -eq "powershell.exe" -and 
    $_.CommandLine -match "(DownloadString|IEX|Invoke-Expression)" -and
    $_.CommandLine -match "(http|https)"
}

if ($processes) {
    foreach ($proc in $processes) {
        Write-Host "[!] Terminating suspicious PID: $($proc.Handle) - $($proc.Name)" -ForegroundColor Red
        Stop-Process -Id $proc.Handle -Force -ErrorAction SilentlyContinue
    }
} else {
    Write-Host "[-] No suspicious PowerShell processes found." -ForegroundColor Green
}

Write-Host "[*] Remediation check complete." -ForegroundColor Cyan
Write-Host "[*] CRITICAL STEP: Force revoke all M365 sessions for affected users via Entra ID Admin Center." -ForegroundColor Yellow