Do Son WordlistLoader malware delivers Amatera Stealer through ClearFake fake-CAPTCHA campaigns, using stealthy evasion to steal browser data.
Amatera Stealer
Malwarebytes finds fake games spreading Amatera Stealer through RenPy Loader, MSBuild abuse, and EtherHiding C2. See the infection chain and defenses.
New Fake CAPTCHA campaign uses Google Calendar & steganography to drop Amatera Stealer. See how this attack exploits legitimate Windows tools to stay hidden.
eSentire exposed the Amatera Stealer campaign using ClickFix social engineering to deliver multi-stage PowerShell. The malware patches AMSI in memory and deploys NetSupport RAT for remote access.
Amatera Stealer, a rebranded and enhanced version of ACR Stealer, uses advanced evasion tactics like NTSockets and WoW64 syscalls to steal data from browsers, crypto wallets, and apps.