MICROSOFT WARNS OF SURGE IN ACR STEALER ATTACKS

Microsoft security researchers identified a rising wave of ACR Stealer infections across its customer base. The malware operates by extracting credentials and authentication data stored in web browsers, creating a direct pathway to compromised accounts and sensitive corporate information. ACR Stealer targets data commonly cached by browsers, including login credentials, session tokens, and cached authentication certificates. Once obtained, attackers can impersonate legitimate users and access protected systems and files without triggering standard security alerts. The malware also harvests local documents from infected systems, enabling theft of confidential business files, intellectual property, and strategic information. This dual-pronged approach makes ACR Stealer particularly dangerous for organizations handling sensitive data. Microsoft has not disclosed specific attack vectors or infection methods in its initial warning, but the surge suggests either improved distribution mechanisms or increased attacker interest in enterprise targets. The company recommends customers implement standard malware prevention measures, including endpoint detection and response (EDR) tools and browser security extensions that monitor for credential theft. Enterprise customers are advised to reset credentials on compromised systems and audit access logs for unauthorized activity. Multi-factor authentication remains critical for limiting damage even if passwords are stolen. The warning adds to growing concerns about password-stealing malware families targeting corporate networks. Similar threats have prompted renewed emphasis on credential security practices and zero-trust architecture principles across the industry. Microsoft continues monitoring ACR Stealer activity and has committed to sharing additional technical details with customers and security partners as the investigation develops.