conhost.exe

• ClickFix campaign abuses Deno runtime for infostealer delivery

  ClickFix campaign abuses Deno runtime for infostealer delivery Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealer Categories: Threat Research Tags: clickfix, Deno, WordPress ClickFix campaign abuses Deno runtime for infostealer deliv

• ACR Stealer: Two observed intrusion chains amid increased threat activity

  ACR Stealer: Two observed intrusion chains amid increased threat activity From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browse

• ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files

  ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files ACR Stealer, an infostealer in circulation since 2024, is walking out of enterprise networks with saved browser passwords, live session tokens, PDFs, Microsoft 365 documents, and files from synced On

All reports →