Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication
Proofpoint has identified Amatera Stealer, a rebranded version of ACR Stealer with enhanced capabilities and evasion techniques. Distributed via ClearFake website injects, it utilizes sophisticated attack chains and web injects. Amatera Stealer employs NTSockets for stealthy C2 communication, WoW64 Syscalls to bypass user-mode hooking, and supports HTTPS requests. It focuses on stealing information from browsers, crypto wallets, and various software. The malware can also execute secondary payloads. Amatera Stealer is actively developed and sold as a malware-as-a-service, with subscription plans ranging from $199 to $1,499.
Pulse ID: 6852f50d17176b71367652f8
Pulse Link: https://otx.alienvault.com/pulse/6852f50d17176b71367652f8
Pulse Author: AlienVault
Created: 2025-06-18 17:19:09
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Browser #ClearFake #CyberSecurity #HTTP #HTTPS #InfoSec #Malware #MalwareAsAService #OTX #OpenThreatExchange #Proofpoint #bot #AlienVault