Amatera Stealer

Proofpoint observed Amatera Stealer distributed via ClearFake website injects in April and May 2025. ClearFake is a web inject activity cluster that compromises legitimate websites with malicious HTML and JavaScript.

In the observed email-based campaigns, messages contained links to compromised websites.

This command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe.

The next step instructed the user to press Ctrl+V, which pastes the command into the Windows Run dialog, followed by the final step of pressing Enter to run the command.

Another interesting feature that was not previously documented relative to this malware is its use of WoW64 Syscalls... this sample defines various functions that stage a Windows API to be resolved and executed dynamically. | The code used to initialize contact with the C2 at this stage leverages NTSockets by interfacing with the device “\\Device\\Afd\\Endpoint” directly, rather than using the Winsock library.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe — a legitimate .NET build tool included in Windows.

When users visited a website compromised by ClearFake, the users were presented with a fake CAPTCHA, asking users to prove they are not a robot. This simple lure triggered the ClickFix technique.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe.

Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.

Next, it uses context hijacking by retrieving and modifying the CPU context of the suspended thread — specifically changing the instruction pointer (EIP) so that when the process is resumed, it begins executing the injected shellcode instead of its original code.

It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state, meaning the process is created but not yet allowed to run.

The .csproj file contained obfuscated logic that reconstructs and runs another layer of Base64-encoded PowerShell... This third PowerShell script is again heavily obfuscated and uses XOR encoding.

Inside the archive is a file called Setup.exe, which is actually a legitimate Python interpreter bundled with malicious scripts... it uses a renamed MSHTA copy disguised as iso2022.exe

The vast majority of detections for mshta.exe come from instances where the command line contains domains that appear to be legitimate services but are hosted on the .cc TLD... Starting in late February 2026... shifted to .vg and .gl TLDs.

Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.

Next, it uses context hijacking by retrieving and modifying the CPU context of the suspended thread — specifically changing the instruction pointer (EIP) so that when the process is resumed, it begins executing the injected shellcode instead of its original code.

It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state, meaning the process is created but not yet allowed to run.

The script first disables PowerShell logging and suppresses output by setting all preference variables (such as ErrorActionPreference, VerbosePreference, etc.) to SilentlyContinue and overriding built-in functions like Write-Host.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe — a legitimate .NET build tool included in Windows.

It uses a 128-byte XOR key to first decrypt the encrypted payload blob, then aPLib to decompress it.

The tool is MSHTA, short for Microsoft HTML Application Host, a built-in Windows utility that can run scripts from local files and remote internet locations... Attackers have been using it to deliver some of today’s most harmful malware... All use MSHTA as a stepping stone during early or middle stages of infection.

The loader simply reconstructs its payload and runs it in memory, so “it never touches the disk.”

Stealing browser data relating to Cookies, Web Forms, Profile Data (web history)

Amatera Stealer currently focuses on stealing information from installed software like browsers, crypto wallets and other software... Stealing browser data relating to Cookies, Web Forms, Profile Data.

Stealing browser data relating to Cookies, Web Forms, Profile Data (web history)

The final payload is most often LummaStealer, designed to harvest browser credentials, session cookies, and cryptocurrency wallet data. Amatera, another stealer in the same chain, targets similar data.

Checks if there are less than 6 running processes ... enumerate running processes and compares each process name

It accomplishes this by searching the file system with glob-syntax search patterns using NtCreateFile and NtQueryDirectoryFile.

The malware initiates contact with its configured command and control (C2) server via HTTP shortly after execution... Samples of Amatera Stealer observed in May 2025 contain code which suggests new support for HTTPS requests.

The script then downloads the shellcode from a remote server directly into memory via a variable... A recent addition to the malware configuration in a JSON key named “ld” ... is used to execute additional payloads.

The malware author appears to directly connect to a hardcoded C2 instead of the previously seen C2 method utilizing intermediary dead-drop resolvers such as Steam, Telegram, or Google Docs.

Upon completion of each function, the malware will submit a POST request with data that is collected by the function responsible for handling capabilities enabled from the initial configuration from the C2.

The script first disables PowerShell logging and suppresses output by setting all preference variables... It then uses the open-source project Null-AMSI to bypass AMSI (AntiMalware Scan Interface) and disable Event Tracing for Windows (ETW).