Credential Theft Is Now a Full-Stack Enterprise Problem
The current wave of enterprise security vulnerabilities shows that attackers are no longer picking off isolated flaws, but systematically targeting every layer that handles authentication, from browser-based malware to remote access VPN portals and cloud-synced documents, turning routine sign-ins into high-value opportunities for credential theft and data exfiltration.
The key takeaway is uncomfortable: enterprise authentication is now one connected attack surface, not a set of separate tools. ACR Stealer malware threatens browser credentials, live tokens, and business documents. The Palo Alto GlobalProtect exploit allows attackers to bypass VPN authentication and establish unauthorized connections into the network perimeter. Together, they show that it no longer matters whether the entry point is a user’s clipboard, a browser extension, or a firewall-adjacent VPN service—the outcome is the same: attackers gain trusted access. Security teams that still treat these domains as separate risk buckets are handing adversaries an advantage. The response must be unified: protect credentials everywhere or accept that a single weak link can invalidate the rest.
ACR Stealer: ClickFix Turns Users into Their Own Exploit Kit
ACR Stealer malware is an information-stealing family that puts browser credentials, live authentication tokens, and business documents at risk. Microsoft Defender Experts have observed increased ACR Stealer activity across enterprise customer environments from April through June, driven by campaigns that abuse user trust rather than software flaws. Both prevalent campaigns begin with ClickFix prompts that trick users into pasting attacker-provided commands into the Windows Run box. This is social engineering upgraded into an execution framework: no exploit, just a lie and a clipboard.
From there, the chains split but share the same goal. One route loads a malicious DLL from a remote WebDAV share via rundll32, then uses obfuscated PowerShell and a bundled Python loader for persistence. Another uses MSHTA to pull remote HTML application content, then executes an encrypted payload hidden in a JPEG largely in memory. Both end by raiding Chromium credential stores and the Windows Data Protection API for passwords, cookies, session data, and tokens. They also enumerate PDFs, Microsoft 365 documents, Desktop and Downloads folders, and cloud directories in OneDrive and SharePoint before exfiltrating the haul. Treat this not as “just another stealer,” but as a direct assault on your browsers-as-identity-hubs model.
GlobalProtect Exploitation: When the VPN Becomes the Weakest Link
While ACR Stealer quietly strips browsers and cloud stores of secrets, attackers are also walking in through the remote access front door. A flaw in the GlobalProtect VPN service, tracked as CVE-2026-0257, can allow attackers to bypass authentication and establish an unauthorized connection. The vulnerability primarily affects the GlobalProtect portal and gateway for PAN-OS, and its CVSS score has been upgraded to 7.8, classed as high severity. Palo Alto announced the upgrade after reports that the flaw was being exploited in the wild. This is not theoretical risk; it is active abuse of perimeter infrastructure.
Analysis has identified successful exploitation across numerous customers, even if lateral movement from compromised devices has not yet been observed. The exploit traffic has been seen since mid-May, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. Some victims had Cloud Authentication Service disabled, others had GlobalProtect authentication override cookies enabled, widening exposure. A patch is now available for affected appliances, and administrators are advised to disable authentication override features as a mitigation. Security experts are blunt that this shows “perimeter defences are prime targets” and that the grace period for patching edge devices has “practically vanished”. If your VPN patch doesn’t outrank internal app updates, your priorities are upside down.
Enterprise Response: Treat Authentication as a Single Attack Surface
Viewed together, ACR Stealer and the GlobalProtect exploit form a clear pattern: attackers are stripping away the assumptions that made enterprise authentication feel safe. Browsers hold passwords and tokens; VPNs validate remote trust; cloud platforms synchronize sensitive documents. ACR Stealer goes after browser credentials and live tokens while enumerating and exfiltrating Microsoft 365, OneDrive, and SharePoint content. The GlobalProtect flaw lets threat actors bypass VPN authentication on unpatched portals and gateways. These are not isolated problems; they are coordinated pressure on identity and remote access.
Defenders need to answer on the same front. Microsoft’s analysis calls for web filtering and execution controls over PowerShell, Python, MSHTA, and rundll32 to cut off documented ACR Stealer delivery paths. More importantly, it highlights that these examples are not exhaustive, warning that blocking only known routes will miss other methods. For any suspected ACR Stealer compromise, revoking authentication tokens is essential, because stolen tokens can preserve account access even after malware removal. On the VPN side, organizations should treat the GlobalProtect patch as urgent, disable authentication override features, and monitor for signs of unauthorized connections. The practical stance is simple: if a component touches authentication, it is now a Tier 0 asset. Protect it accordingly or expect it to be the point of failure.
Conclusion: Security Teams Must Collapse Their Silos Before Attackers Do
Enterprise security vulnerabilities are converging around the same prize: credentials and the systems that trust them. ACR Stealer malware abuses user prompts, WebDAV, and MSHTA to turn browsers and cloud storage into data sources. The Palo Alto GlobalProtect exploit shows that attackers no longer hesitate to target VPNs and firewalls themselves, using an authentication bypass to gain unauthorized connections. These issues collectively target the enterprise authentication layer and remote access infrastructure, undermining the very tools that were supposed to keep outsiders out.
The conclusion for security leaders is harsh but necessary: defenses organized around tool categories—endpoint, network, cloud—are now less useful than defenses organized around trust boundaries and credentials. The attackers have already collapsed these silos; they treat a stolen browser token and a bypassed VPN check as two sides of the same win. Enterprises that fail to do the same will keep “patching” symptoms instead of addressing the disease. The way forward is to treat identity, VPNs, and browser-based auth as one continuous surface, apply strict execution controls, patch edge devices fast, and revoke tokens aggressively after any hint of compromise. Anything less is denial, and adversaries are exploiting that too.
