Do Son 
The fake-reCAPTCHA lure HTML as it lives on-chain
At a Glance
| Category | Details |
|---|---|
| Malware Family | Amatera (rebrand of ACR Stealer / AcridRain) |
| Threat Actor | Unattributed (overlaps with ErrTraffic Malware-as-a-Service ecosystem) |
| Target or Victims | Visitors of hundreds of compromised WordPress websites |
| Delivery Vector | Rogue WordPress plugin, browser Service Worker, fake reCAPTCHA ClickFix lure |
| Key Capabilities | Browser persistence, CSP stripping, EtherHiding blockchain resolution, credential theft |
| Source | Netskope Threat Labs |
TL;DR
A cyber campaign compromised hundreds of WordPress websites to distribute the Amatera password stealer. Attackers combine persistent browser Service Workers with smart contracts on the Base blockchain to serve fake reCAPTCHA lures. Users who execute the suggested ClickFix commands infect their systems with fileless credential-stealing malware.
Delivery
The multi-stage attack begins on a compromised WordPress site. Attackers plant a rogue must-use plugin in the WordPress directory. WordPress loads this plugin automatically on every user request. Consequently, the malicious code executes on trusted domains without raising suspicion.
Next, the plugin registers a persistent Service Worker directly in the visitor’s browser. This worker operates independently of the website server. It intercepts page loads, strips Content-Security-Policy headers, and injects malicious scripts. Moreover, the worker checks user cookies to hide its activity from administrators. The threat actors deliberately shield logged-in site owners to prolong dwell time.
The injected script connects to the Base blockchain through public endpoints. It retrieves payload data stored inside a smart contract. This method, known as EtherHiding, ensures the compromised site never hosts the malicious payload. Therefore, operators avoid traditional server seizures. The smart contract serves a fake Google reCAPTCHA panel. This lure prompts the user to copy a command, open the Windows Run box, and execute the payload manually. This social engineering tactic represents the ClickFix technique.
Infection Chain
Once the victim executes the command, the Windows HTML Application utility fetches an MP3 polyglot file. This file hides an HTA payload inside a valid audio container. The utility parses the HTA code and initiates a hidden scheduled task.
Next, the task launches a fileless PowerShell process. This stage bypasses security boundaries and patches memory structures to disable the Antimalware Scan Interface. The script then retrieves the Emmenhtal loader from a remote server masquerading as security software.
Afterward, the loader retrieves an image from a public content delivery network. This image uses steganography to conceal an encrypted binary within its pixel data. The loader extracts the payload, decrypts the code, and reflectively loads the final executable into memory. As the researchers noted, “What we found through peeling all nine layers is the same design choice to have no durable artifacts to act on, no file to hash, no server to seize, no download to inspect.”
Command-and-Control and Data-Exfiltration Behaviour
The unpacked payload is the Amatera password stealer, a rebrand of the ACR Stealer family. The binary impersonates the legitimate Windows Performance Analyzer tool to blend into running processes. It extracts saved credentials, browser data, and system telemetry from the compromised endpoint.
To evade network inspection, the Amatera password stealer uses DNS-over-HTTPS for domain resolution. It queries public providers like Google and Cloudflare to locate its command server. Afterward, the malware establishes an encrypted TLS session to exfiltrate stolen credentials. The malware also installs a root certificate to weaken local security controls.
According to the Netskope Threat Labs report on EtherHiding and Amatera, “We have not seen a Service Worker resolve its payload from a smart contract before, and it was the combination that made us pull the chain apart.” This architectural approach allows operators to update endpoints without modifying deployed malware binaries.
Defense and Detection Guidance
Defending against this campaign requires layered endpoint and browser security controls. System administrators must audit WordPress installations for unauthorized must-use plugins. Website owners should also verify that their web servers do not load unexpected scripts.
Security teams should block unauthorized PowerShell executions originating from scheduled tasks or system utilities. Furthermore, organizations should deploy endpoint detection tools capable of identifying AMSI patching and reflective memory loading. Network defenders should monitor unusual outbound connections to blockchain RPC endpoints.
Finally, user training remains critical. Organizations must train employees to recognize ClickFix lures. Users should never paste unverified commands into the Windows Run dialog. Combining user awareness with strict application controls prevents this attack chain from succeeding.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
