Loading malware…
Amatera Stealer is a Windows information-stealing malware family sold as a malware-as-a-service offering and widely assessed as a rebranded, actively developed successor to ACR Stealer. It has been linked to criminal distribution ecosystems that also deliver other commodity stealers and loaders, and has been observed in campaigns using fake software and game downloads, cracked software lures, malicious website injects, ClickFix social engineering, and multi-stage loader chains involving tools such as RenPy Loader, GoFlateLoader, CountLoader, MSHTA-based chains, and EtherHiding-enabled downloaders. It has also been associated with ClearFake-style web inject activity and malvertising-driven fake installer campaigns.
The malware’s core purpose is theft of sensitive data from infected systems. Reported collection targets include browser-stored credentials, cookies and session data, cryptocurrency wallets and wallet browser extensions, password managers, messaging and email applications, SSH and FTP tools, and selected local files. Multiple analyses also describe expanded harvesting of desktop wallet applications, Discord and Signal-related data, and file-grabber logic focused on potentially valuable documents and wallet material. Some reporting indicates the malware can bypass Chrome App-Bound Encryption by injecting code into Chromium-based browsers to access protected data.
Amatera is described as a C++ stealer with ongoing feature development focused on stealth and evasion. Public analyses attribute to it direct or low-level networking approaches, including NTSockets-based communication and syscall-driven execution intended to reduce visibility to user-mode monitoring. Additional anti-analysis behavior reported across samples includes string encryption, dynamic API resolution, anti-debugging checks, sandbox and environment screening, geofencing logic, and in-memory execution through reflective or shellcode-based loaders. Some observed chains establish persistence, including scheduled-task creation or autorun mechanisms, and newer configurations reportedly support downloading and executing additional payloads, extending the malware beyond pure collection into broader post-compromise activity.
Victimology is broad and opportunistic, with campaigns targeting consumers and enterprises through commodity infection channels. Observed lures have included fake game, mod, crack, and software installers, fake verification pages impersonating major web services, and developer-focused malvertising. Finance-sector targeting has also been reported in at least one intercepted intrusion. Amatera is positioned in the cybercrime ecosystem as an alternative commodity stealer and has gained traction in campaigns that previously relied on other MaaS stealers.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In late April 2026, eSentire's Threat Response Unit (TRU) intercepted an attempted delivery of Amatera Stealer within a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACR (AcridRain) Stealer, a C++ based information stealer previously marketed as Malware-as-a-Service (MaaS) on underground forums by the threat actor SheldIO.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access Drive-by Compromise; User Execution ClickFix lure prompts command execution.
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
This command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe.
As a result, users unknowingly execute a malicious PowerShell command, enabling malicious loaders to be launched at the next stage on the device.
Another interesting feature that was not previously documented relative to this malware is its use of WoW64 Syscalls... this sample defines various functions that stage a Windows API to be resolved and executed dynamically. | The code used to initialize contact with the C2 at this stage leverages NTSockets by interfacing with the device “\\Device\\Afd\\Endpoint” directly, rather than using the Winsock library.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
Run a full Windows malware scan. Scan the original archive, Downloads, Temp, AppData, startup locations, scheduled tasks, and browser-related data.
Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.
The .csproj file contained obfuscated logic that reconstructs and runs another layer of Base64-encoded PowerShell... This third PowerShell script is again heavily obfuscated and uses XOR encoding.
Observations indicate that such campaigns make use of fake interfaces impersonating Google reCAPTCHA and Cloudflare verification pages, as well as deceptive pages associated with Google Meet, QR code services and other well-known platforms.
Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.
The script first disables PowerShell logging and suppresses output by setting all preference variables (such as ErrorActionPreference, VerbosePreference, etc.) to SilentlyContinue and overriding built-in functions like Write-Host.
The suspicious pattern is MSBuild starting from a newly extracted game-installer directory, reading unexpected project files, loading code from a user-writable path, and then making network connections or spawning later stages. MITRE tracks this type of abuse as Trusted Developer Utilities Proxy Execution: MSBuild.
If the suspicious installer ran, assume browser-saved passwords, cookies, authentication tokens, Discord or gaming sessions, and wallet data may have been exposed.
If the suspicious installer ran, assume browser-saved passwords, cookies, authentication tokens, Discord or gaming sessions, and wallet data may have been exposed.
193 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Final payload delivered by the documented RenPy Loader campaign; an information stealer.
An information stealer delivered via fake verification-page ClickFix lures.
Infostealer final de la chaîne d’infection, conçu pour voler mots de passe et données de navigateurs, portefeuilles de cryptomonnaies, extensions de navigateur, applications de messagerie, fichiers locaux, identifiants et données de session.
A stealer family referenced as using the same Python runtime plus payload delivery vehicle seen in this ecosystem.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.