EN PT-BR
← Voltar ao feed
high technology

Amatera infostealer tops ESET's Latin America detections, spread via ClickFix and fake AI tool ads

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 05:00 · coletado há 2 dias

ESET published an overview of Amatera, a Windows C++ infostealer sold as malware-as-a-service that topped the vendor's infostealer detections in Latin America in H1 2026 while targeting victims worldwide. First seen in 2024, Amatera is very likely a rebrand of ACR Stealer, itself described by Sekoia in May 2024 as an updated GrMsk stealer; by late 2024 it was being offered at $199/month with Telegram support. The malware harvests browser credentials, cookies, histories, form data and session tokens, hunts sensitive files synced with OneDrive and SharePoint, and — per Straiker — targets cryptocurrency wallets via clipboard manipulation. Distribution is affiliate-driven: compromised WordPress sites, search engine ads and SEO poisoning, targeted emails, fake documents, SVG files and ClickFix fake CAPTCHAs. Microsoft reported a surge in related attacks on enterprise customers between late April and mid-June 2026.

Detalhes técnicos

  • ClickFix variants observed: AI-fix (pages impersonating Anthropic Artifacts, OpenAI Canvas, Microsoft Copilot Pages), CrashFix (fake ad blocker triggering fake browser crashes), and ConsentFix (tricking victims into granting OAuth tokens to Microsoft accounts without stealing a password).
  • Straiker uncovered dozens of fake install pages promoted via paid ads and SEO poisoning impersonating Claude Code, NotebookLM, JetBrains, Comet and Snowflake, aimed at developers using AI tools.
  • Compromised WordPress sites were accessed through weak or stolen admin credentials or exploitation of theme/plugin vulnerabilities.
  • Post-compromise activity included additional payloads, scheduled task creation, use of legitimate system tools and anti-forensic cleanup (PowerShell history clearing).
  • ESET detects the family as Win/PSW.Amatera; ClickFix detections rose over 500% in H1 2025, fell in H2 2025, then more than doubled in H1 2026.

Remediação

  • Treat any page asking users to copy commands into the Run dialog, PowerShell or Terminal as malicious, including those mimicking AI services.
  • Enforce application control and restrict system interpreters/LOLBins outside normal context.
  • Monitor PowerShell, Rundll32, WebDAV, unusual scheduled tasks and PowerShell history clearing.
  • Use phishing-resistant authentication, shorten browser session lifetimes, separate personal and work browser profiles, and avoid storing secrets in browsers.
  • On confirmed compromise, isolate the host then, from a trusted device, revoke sessions, reset passwords and rotate API keys, tokens and SSH credentials; review access to mail, cloud, repositories and financial apps.

Linha do tempo

  1. welivesecurity.com ↗ · pub. 29/10/2026 05:00 · coletado 30/10 08:00 primeiro registro

    Amatera infostealer tops ESET's Latin America detections, spread via ClickFix and fake AI tool ads

    ler a análise desta fonte

    ESET published an overview of Amatera, a Windows C++ infostealer sold as malware-as-a-service that topped the vendor's infostealer detections in Latin America in H1 2026 while targeting victims worldwide. First seen in 2024, Amatera is very likely a rebrand of ACR Stealer, itself described by Sekoia in May 2024 as an updated GrMsk stealer; by late 2024 it was being offered at $199/month with Telegram support. The malware harvests browser credentials, cookies, histories, form data and session tokens, hunts sensitive files synced with OneDrive and SharePoint, and — per Straiker — targets cryptocurrency wallets via clipboard manipulation. Distribution is affiliate-driven: compromised WordPress sites, search engine ads and SEO poisoning, targeted emails, fake documents, SVG files and ClickFix fake CAPTCHAs. Microsoft reported a surge in related attacks on enterprise customers between late April and mid-June 2026.

    Technical Details

    • ClickFix variants observed: AI-fix (pages impersonating Anthropic Artifacts, OpenAI Canvas, Microsoft Copilot Pages), CrashFix (fake ad blocker triggering fake browser crashes), and ConsentFix (tricking victims into granting OAuth tokens to Microsoft accounts without stealing a password).
    • Straiker uncovered dozens of fake install pages promoted via paid ads and SEO poisoning impersonating Claude Code, NotebookLM, JetBrains, Comet and Snowflake, aimed at developers using AI tools.
    • Compromised WordPress sites were accessed through weak or stolen admin credentials or exploitation of theme/plugin vulnerabilities.
    • Post-compromise activity included additional payloads, scheduled task creation, use of legitimate system tools and anti-forensic cleanup (PowerShell history clearing).
    • ESET detects the family as Win/PSW.Amatera; ClickFix detections rose over 500% in H1 2025, fell in H2 2025, then more than doubled in H1 2026.

    Remediation

    • Treat any page asking users to copy commands into the Run dialog, PowerShell or Terminal as malicious, including those mimicking AI services.
    • Enforce application control and restrict system interpreters/LOLBins outside normal context.
    • Monitor PowerShell, Rundll32, WebDAV, unusual scheduled tasks and PowerShell history clearing.
    • Use phishing-resistant authentication, shorten browser session lifetimes, separate personal and work browser profiles, and avoid storing secrets in browsers.
    • On confirmed compromise, isolate the host then, from a trusted device, revoke sessions, reset passwords and rotate API keys, tokens and SSH credentials; review access to mail, cloud, repositories and financial apps.