Amatera Overview
Amatera is a Windows infostealer first seen in 2024. It is written in C++ and is distributed as a malware-as-a-service (MaaS) offering. Affiliates subscribe to a control panel and receive technical support via Telegram, while the developers maintain the code base and infrastructure.
Data Harvested by Amatera
The malware collects a broad set of credentials and artifacts. Browser-stored usernames and passwords, cookies, browsing history, form data, and session tokens are extracted. It also scans for documents and files synchronized with OneDrive or SharePoint, and it manipulates the clipboard to capture cryptocurrency wallet information. The breadth of data makes a single infection a potential gateway to account hijacking, financial fraud, and enterprise data exfiltration.
Delivery Channels
Amatera reaches victims through multiple vectors. Attackers compromise legitimate websites, place malicious code in search-engine advertisements, send targeted phishing emails, embed fake documents or SVG files, and deploy the ClickFix technique. ClickFix mimics a CAPTCHA or browser error and instructs the user to copy a command and run it locally. Variants such as AI-fix, CrashFix, and ConsentFix have been observed, each exploiting different user interfaces.
ClickFix Mechanics
ClickFix relies on social engineering. A pop-up appears that claims a technical issue and offers a “quick fix.” The user is prompted to copy a command and execute it. The keystrokes entered by the victim activate the compromise. Since 2024, ClickFix has been used to distribute a wide range of malware families.
Mitigation Recommendations
Defenders should block known delivery URLs and monitor for ClickFix pop-ups. Enforce multi-factor authentication on administrative accounts and patch or disable vulnerable WordPress plugins that attackers use to host malicious pages. Detect clipboard manipulation patterns that indicate wallet data theft. Maintain an up-to-date inventory of installed software and monitor for unauthorized changes to identify Amatera infections early.
Implications for Enterprise Users
Amatera’s ability to harvest files from OneDrive and SharePoint means that compromised credentials can lead to data exfiltration from cloud storage. Enterprises should audit access logs for anomalous activity, enforce least-privilege access, and consider endpoint detection and response solutions that flag clipboard manipulation.
MaaS Model and Threat Landscape
The subscription model demonstrates a mature supply chain for infostealers. Affiliates can deploy the malware without developing it themselves, lowering the barrier to entry for attackers. This commercial approach indicates that Amatera should be treated as a persistent, repeatable threat rather than an isolated incident.
Where to Find More Technical Details
For a deeper technical dive, review the Zero-Day Vulnerability & CVE Exploit Matrix. The matrix provides context on related vulnerabilities that could be leveraged in similar campaigns.
Related Coverage
- GMO Internet Group Offers $1 Million Bounty After FX Trading Cloud Breach
- Yoba Crypto Miner Campaign Uses Signed AI Binaries to Deploy Malicious DLLs