Microsoft published a detailed threat report this month on a malware family called ACR Stealer, and the way it’s getting onto machines should worry any UK business whose staff spend their day clicking links in email. Between late April and mid-June, Microsoft Defender Experts tracked a sharp rise in ACR Stealer activity across customer environments, almost all of it delivered through a technique called “ClickFix” — and unlike most malware, this one doesn’t rely on a dodgy attachment or a drive-by download. It relies on the victim doing the infecting themselves, one paste at a time.

Here’s how it works. You land on a page — often one that’s been hijacked rather than freshly built by the attacker — showing what looks like a normal “Verify you’re human” CAPTCHA or a Cloudflare security check. Instead of clicking a box, you’re told the automatic verification failed and given instructions: open the Windows Run dialog, paste this code, hit enter. The “code” is already sitting on your clipboard, because the page copied it there the moment you loaded it — a trick called pastejacking. What actually runs is a PowerShell or MSHTA command that quietly installs ACR Stealer, which then harvests browser-saved passwords, authentication tokens, and any Microsoft 365 documents it can reach, before phoning home.

Why this one gets past people who’d never open a suspicious attachment

Standard security training tells people not to download files from strangers or click unexpected links. ClickFix doesn’t ask for either. It asks the user to fix a problem — a broken form, a failed verification, a meeting that “won’t load” — using an instruction that looks exactly like the kind of copy-paste tech support step people follow all the time. Microsoft’s researchers found two distinct versions of the campaign in the wild: one using WebDAV-hosted payloads and staged PowerShell, the other a fileless route using obfuscated scripts and steganography to dodge antivirus scanning. Both end the same way — stolen credentials and session tokens that let an attacker walk straight into cloud accounts without needing to guess a password at all.

What to actually do about it this week

The single most useful thing you can do is retire the instinct that “paste this into Run” is ever a normal instruction from a website. Brief your team specifically on this pattern — not generic “phishing awareness,” but the exact scenario: a verification prompt that asks you to open a system dialog and paste something. No legitimate CAPTCHA, browser update, or meeting tool ever requires that step, and any page that does should be closed immediately.

Beyond training, check whether your endpoint protection actually flags PowerShell and MSHTA execution from browser-launched processes — many default consumer antivirus setups don’t, which is exactly the gap this malware is built to exploit. If your business relies on ad hoc IT support rather than a properly configured security stack, CoolCoding can review and harden that configuration so scripting abuse like this gets blocked before it runs, not after. And because stolen session tokens can bypass MFA entirely, ongoing monitoring matters as a backstop — KeepSafe is built to catch exactly this kind of compromise early, when accounts start behaving strangely rather than after data has already left the building.

The takeaway

ClickFix succeeds because it turns your staff into the delivery mechanism, bypassing every filter built to catch a malicious file. Add “never paste anything into Run or a terminal because a website told you to” to your security briefing this week, and check that your endpoint tools are actually watching for the scripting behaviour this attack depends on.