Amatera, a Windows infostealer sold as a subscription service, topped ESET's infostealer detections in Latin America in the first half of 2026, although it targets victims worldwide. According to ESET researcher Mario Micucci, writing on WeLiveSecurity, the malware steals login credentials, session cookies, tokens, crypto wallet information and files, and is a clear example of how cybercrime has professionalised.
A rented product. Amatera is written in C++ and was first observed in 2024. It runs under the malware-as-a-service model: developers maintain the code, control panel and support, while affiliates pay to run their own campaigns. By the end of 2024 it was on offer for $199 a month, with support via Telegram. ESET says it is very likely a rebrand of ACR Stealer, itself described by Sekoia as an updated version of the GrMsk stealer.
What it steals. The malware extracts browser-stored credentials, cookies, browsing histories, form data and session tokens. It can also grab sensitive documents synced with OneDrive or SharePoint; ESET notes that Microsoft reported a surge in attacks on its enterprise customers between late April and mid-June 2026. Separately, researchers at Straiker found it targeted crypto wallet data by manipulating the clipboard.
The ClickFix trick. A key delivery method is ClickFix: victims see a fake CAPTCHA check or browser error telling them to copy a command and run it on their computer, so their own keystrokes start the infection. Variants include AI-fix pages impersonating AI services, CrashFix, which fakes browser crashes via a bogus ad blocker, and ConsentFix, which tricks users into handing over OAuth tokens for their Microsoft accounts. ESET says ClickFix detections more than doubled in the first half of 2026.
Fake AI tool ads. Affiliates also buy search ads. Straiker uncovered dozens of fake install pages promoted through paid ads and SEO poisoning that impersonated tools such as Claude Code, NotebookLM, JetBrains, Comet and Snowflake, specifically targeting developers who use AI tools. Other routes include compromised WordPress sites, targeted emails, fake documents and SVG files.
Why it matters
One click, many losses. ESET warns that a single compromise can lead to account hijacking, financial fraud and crypto theft, and can open the door to the victim's employer when personal and work profiles share one browser. Stolen passwords, cookies and tokens remain valuable even after the device is cleaned, and can be sold to other criminals days later.
- Never paste commands from a web page into Run, PowerShell or Terminal: no real CAPTCHA or error asks for this.
- A search ad is no proof a site is official, even if it looks like a well-known AI service.
- Keep personal and work browser profiles separate and avoid saving secrets in the browser.
- If infected, from a clean device revoke sessions, reset passwords and rotate API keys, tokens and SSH credentials.
Source: WeLiveSecurity (ESET)
Leave a Reply