Tag: amatera stealer

4 Attack Reports | 0 Vulnerabilities

Attack reports

InstallFix: How attackers are weaponizing malvertized install guides

A new attack technique called InstallFix targets users by cloning popular developer tool installation pages and presenting malicious install commands. Attackers distribute these fake pages through Google Ads, exploiting users' trust in familiar 'curl to bash' installation methods. The campaign spec…

social engineering

amatera stealer

Published: March 9, 2026

Downloadable IOCs: 6

EVALUSION Campaign Delivers Amatera Stealer and NetSupport...

The eSentire Threat Response Unit identified a malware campaign using ClickFix as an initial access vector to deploy Amatera Stealer and NetSupport RAT. Amatera Stealer is a rebranded version of ACR Stealer, with advanced evasion techniques like WoW64 SysCalls to bypass security solutions. It targe…

information theft

c2 communication

evasion techniques

amatera stealer

Published: November 18, 2025

Downloadable IOCs: 1

SVG Phishing hits Ukraine with Amatera Stealer, PureMiner

A phishing campaign targeting Ukrainian government entities uses malicious SVG files to initiate an infection chain. The attack begins with emails containing SVG attachments that redirect victims to a download site. A CHM file is then used to execute a remote HTA loader, which delivers two malware …

amatera stealer

Published: September 26, 2025

Downloadable IOCs: 0

Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication

Proofpoint has identified Amatera Stealer, a rebranded version of ACR Stealer with enhanced capabilities and evasion techniques. Distributed via ClearFake website injects, it utilizes sophisticated attack chains and web injects. Amatera Stealer employs NTSockets for stealthy C2 communication, WoW64…

malware-as-a-service

information stealer

amatera stealer

Published: June 18, 2025

Downloadable IOCs: 12

Click here to see more Attack Reports