ACR Stealer Uses MSHTA and Steganographic JPEGs for Fileless Credential Theft