Microsoft Sounds the Alarm on a Password-Stealing Surge

Microsoft has flagged a significant rise in attacks using a piece of malware called ACR Stealer, according to Bleeping Computer. Between late April and mid-June, attackers used it to raid saved browser passwords, session tokens (the digital keys that keep you logged in without re-entering your password), and sensitive documents from enterprise systems.

ACR Stealer operates as malware-as-a-service (MaaS), meaning attackers rent access to the tool rather than building it themselves — think of it like a criminal franchise. It is believed to be a rebranded version of an older tool called Amatera Stealer.

The most common delivery method is ClickFix, a social engineering (psychological manipulation) trick where a fake error message or CAPTCHA prompts you to paste a command into your computer's terminal. Once you do, the malware installs itself, creates a disguised scheduled task to survive reboots, wipes its own tracks from PowerShell history, and quietly injects its payload into a legitimate system process to avoid detection.

One particularly clever variant hides its actual payload inside a publicly hosted JPEG image — a technique called steganography — then decrypts and runs it entirely in memory, leaving little trace on disk.

Once inside, it goes after everything: passwords, cookies, authentication tokens, PDF files, Microsoft 365 documents, and anything sitting in your Downloads or Desktop folders. OneDrive and SharePoint directories are also targeted.

What to do: Never paste commands into a terminal window because a website tells you to — no legitimate service works this way. If you manage a network, restrict tools like PowerShell and MSHTA from loading content from remote or user-writable locations.

Age verification is becoming law in more than 30 countries, and most platforms currently handle it the same way: capture your face, send it to a server, and run the check there. That model has a problem, as Bleeping Computer reports: centralised biometric databases are a breach waiting to happen, and the attackers are increasingly using AI to speed up the assault.

Incode Technologies, an identity verification firm, tracked what it calls agentic fraud — fraud attempts carried out autonomously by AI agents rather than human operators. In 2024, those AI-driven attacks made up 3% of fraud attempts on its platform. By early 2026, that figure had reached 40%. Incode estimates it will exceed 90% within 18 months.

The answer being proposed is on-device facial estimation: the check runs on your phone or laptop, and your face never leaves it. If it is never transmitted, it cannot be intercepted. If it is never stored, it cannot be breached.

What to do: When any app or website requests biometric data, check its privacy policy for whether data is processed locally or sent to a server. Prefer services that commit to on-device processing.

CVE ID not confirmed in source — check the original advisory before acting.

What 7-Zip is: 7-Zip is a free, widely used file compression and extraction tool for Windows that handles formats including ZIP, RAR, and XZ archives.

What it is: A heap-based buffer overflow (a flaw where a program writes more data than a memory region can hold, spilling into adjacent memory) exists in how 7-Zip processes XZ-compressed archive data. A specially crafted archive file can trigger this overflow and allow an attacker to run arbitrary code on the victim's machine, according to Bleeping Computer.

Who's at risk: Anyone running 7-Zip below version 26.02 on Windows who opens archive files from untrusted sources.

CVSS: Not yet scored — treat as High until confirmed.

Root cause: 7-Zip's XZ decompression routine failed to track remaining available space in the output buffer correctly. Without that check, the decoder could write beyond the buffer's boundary, corrupting adjacent memory in a way an attacker can control. The fix in version 26.02 adds a boundary check so the decoder stops before overflowing.

Attack vector: An attacker crafts a malicious XZ archive and delivers it via phishing email or a compromised download link. The victim opens the file in 7-Zip. During decompression, the malformed data triggers the buffer overflow. The attacker's code executes with the same privileges as the user who opened the file. No elevated access is needed on the attacker's side — just a convincing enough reason for the victim to open the file. Think of it like a parcel that explodes when the recipient cuts the tape.

Detection strategies: Watch for 7-Zip processes spawning unexpected child processes (particularly cmd.exe or PowerShell). Monitor for unusual outbound network connections originating from the 7-Zip process. Check for newly created scheduled tasks or registry run keys appearing immediately after archive extraction.

Recommended actions:

1. Download and install 7-Zip version 26.02 manually from 7-zip.org — there is no automatic update.
2. Until patched, avoid opening archive files received from unknown senders or unfamiliar websites.
3. If you manage endpoints, consider application control policies that alert on unexpected child processes spawned by archive utilities.

The 2026 SANS AI Survey found that 78% of security practitioners now use generative AI in their daily work — but the same research, covered by Help Net Security, highlights that human judgement remains the most effective check against AI-driven attacks.

Separately, researchers at Tracebit found that planting "context bombs" (deliberately misleading information seeded into environments to confuse AI agents) significantly slowed automated attackers from completing their objectives.

You do not need a security team to apply the core principle: slow down and question anything that creates urgency. Phishing and social engineering attacks, including the ClickFix technique spreading ACR Stealer, work because they pressure you to act before you think.

What to do: Before clicking, pasting, or downloading anything unexpected, pause for ten seconds and ask: did I request this? If the answer is no, close the window.

More than 30 age verification laws are now enforceable worldwide, according to Bleeping Computer. The UK's Online Safety Act will restrict under-16 social media access from spring 2027. Australia has already introduced under-16 rules and is considering doubling maximum fines to $99 million following early non-compliance. Half of U.S. states now mandate some form of age verification. For everyday users, this means more platforms will request identity or biometric checks. Ask before you hand anything over: is this processed on my device or sent to a server?