> TritonInfoSec News
Home / Jul 19, 2026 / Story
0
#6 The Hacker News general July 17, 2026 at 08:56 UTC

ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

By [email protected] (The Hacker News)

AI Summary

ACR Stealer, an infostealer active since 2024, is being delivered via ClickFix lures that trick users into pasting malicious commands into the Windows Run dialog. Microsoft's Defender Experts team documented two delivery chains showing the malware exfiltrating saved browser passwords, live session tokens, PDFs, and Microsoft 365 documents including files synced from OneDrive and SharePoint.

Read full article → https://thehackernews.com/2026/07/acr-stealer-uses…

Relevance score: 79.0/100

# More from July 19

  1. 1
    WordPress Core "wp2shell" RCE flaws get public exploits, patch now BleepingComputer
  2. 2
    Update now: 7-Zip fixes RCE flaw exploitable with malicious archives BleepingComputer
  3. 3
    Fresh SharePoint Vulnerability Exploited Soon After Disclosure SecurityWeek
  4. 4
    Leading members of Scattered Spider sentenced in UK to 66 months in jail CyberScoop
  5. 5
    HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload BleepingComputer
  6. 7
    Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT The Hacker News
  7. 8
    Ernst & Young discloses data breach after support system hack BleepingComputer
  8. 9
    New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage The Hacker News
  9. 10
    Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man The Hacker News