Microsoft warns of ACR Stealer malware surge targeting enterprise credentials
Enterprise browsers store authentication tokens and passwords; a surge in targeted credential theft affects organizational security posture.
What ACR Stealer targets
ACR Stealer is malware designed to extract credentials and sensitive data from web browsers used in enterprise environments. It harvests stored passwords, authentication tokens that grant access to cloud services, and documents cached locally.
Microsoft reports observing a notable increase in attacks using this tool against its enterprise customers. The malware focuses on information that can enable lateral movement within corporate networks or access to cloud infrastructure.
Why browser-stored credentials matter
Modern single sign-on systems often rely on tokens stored in browser local storage or cookies. These tokens can remain valid for extended periods, allowing attackers who steal them to impersonate legitimate users without needing the actual password.
Organizations that use password managers integrated with browsers or allow browsers to remember credentials create a concentrated target. Compromising one endpoint can yield access to dozens of services.
Mitigation approaches
Security teams should audit which systems allow browser-based credential storage and consider enforcing hardware token authentication for high-value systems. Regular token rotation and session timeout policies reduce the window of opportunity for stolen credentials.
Endpoint detection tools can monitor for unusual access patterns to browser credential stores. Employee training on recognizing phishing and malware delivery methods remains foundational, as initial compromise often begins with social engineering.