Amatera Stealer Rents for $199 and Gets You to Install It Yourself

Amatera, a stealer-for-rent that’s very likely the rebranded ACR Stealer, was the most-detected infostealer in Latin America in the first half of 2026, ahead of Formbook, Vidar and Lumma, ESET says in a new explainer. It rents for about $199 a month, takes browser passwords, cookies and session tokens plus synced OneDrive and SharePoint files, and mostly gets in by talking the victim into pasting a command themselves: the ClickFix trick.

looksta[.]icu
contrite.quirksturdy[.]icu
ux.strainedeasily[.]icu
breaksd.wifihot[.]icu
walter.filloco[.]icu
fast.raidher[.]icu
apigrokcloud[.]icu
cpppemwjewjoiwejow[.]sale
enhanceblabber[.]cc
creativecommunityinfo[.]art

Source article: Amatera: How the prolific infostealer works and spreads
Publisher: ESET WeLiveSecurity (Mario Micucci)
Published: October 29, 2026
URL: https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/

Executive Summary

Amatera is a C++ Windows infostealer first observed in 2024 and sold as malware-as-a-service (about $199 a month with Telegram support by late 2024), detected by ESET as Win/PSW.Amatera; it is very likely a rebrand of ACR Stealer, which is itself an updated version of the GrMsk stealer, and Microsoft tracks the current activity as ACR Stealer. No operator or affiliate group is named. ESET ranks it the most-detected infostealer in Latin America in H1 2026, and Microsoft Defender Experts saw a surge of ACR Stealer intrusions against enterprise customers between late April and mid-June 2026. Delivery relies on ClickFix-style paste-and-run lures (fake CAPTCHAs and browser errors, “AI-fix” pages impersonating Claude Artifacts, OpenAI Canvas and Copilot Pages, the CrashFix fake ad blocker), compromised WordPress sites, and malvertising and SEO poisoning for fake installers of Claude Code, NotebookLM, JetBrains, Comet and Snowflake. Microsoft documents two chains: a pasted command that makes rundll32 load a DLL from a WebDAV share, followed by obfuscated PowerShell that drops a bundled pythonw.exe and Python loader into a deceptive folder under %LocalAppData%\Temp, creates a hidden logon scheduled task disguised as an update, timestomps from notepad.exe, clears PowerShell history, injects the payload via the Windows Fiber API and in some cases resolves follow-on infrastructure from public blockchain RPC endpoints (EtherHiding); and a pasted command that launches mshta against a remote HTA, whose VBScript starts PowerShell that pulls a steganographic JPEG and reflectively loads shellcode. Both chains decrypt Chromium Login Data and Web Data with DPAPI and collect PDFs, Microsoft 365 documents and OneDrive/SharePoint-synced files for exfiltration; the impact is credential and session-token theft that enables account takeover. Hunt leads, false positive expectations and indicators are detailed below; neither source publishes YARA, Sigma or file hashes.

ATT&CK chain: Resource Development → Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Collection → Command and Control

Hunt Lead Grid

ACR Stealer Infrastructure Sweep

Microsoft published the domains behind both ACR Stealer chains it observed from late April to mid-June 2026. For the WebDAV and Python chain, the C2 hosts are looksta[.]icu, contrite.quirksturdy[.]icu, ux.strainedeasily[.]icu, cpppemwjewjoiwejow[.]sale, breaksd.wifihot[.]icu, walter.filloco[.]icu, fast.raidher[.]icu and apigrokcloud[.]icu. For the MSHTA and steganography chain, enhanceblabber[.]cc is the C2, deep-harborio[.]com, auramatrixa[.]com, zealpraxis[.]com, prism-vertex[.]com, prism-matrixs[.]com and proton-network[.]com host the first stage, and creativecommunityinfo[.]art hosts payloads. The detection logic is a retrospective match of these hostnames, including subdomains, in DNS, proxy, secure web gateway and EDR network telemetry, and a match of the same names inside RunMRU values and process command lines, since the ClickFix command itself carries the first-stage host.

Sweep back to April 1, 2026, which covers Microsoft’s observation window, and keep the list live for new hits. DNS and proxy logs are the primary sources; EDR network events add the initiating process, which tells you whether rundll32, mshta, PowerShell or pythonw.exe made the call. Blocking the whole .icu or .cc TLD is the wrong control for most environments, since it causes collateral damage and these operators rotate hostnames quickly; block the exact names and use the hits to pivot. Any confirmed resolution from an endpoint should go straight to the chain leads below and to credential rotation for the user, because by the time the C2 is contacted the browser data may already be gone.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols), T1105 (Ingress Tool Transfer)

Sources: “ACR Stealer: Two observed intrusion chains amid increased threat activity”, Microsoft Security Blog, July 16, 2026, https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ (additional source, same malware family; ESET links it); “Amatera: How the prolific infostealer works and spreads”, ESET, Oct. 29, 2026, https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/ (source article)

ClickFix Rundll32 Loading a DLL From WebDAV

In Microsoft’s first chain the ClickFix lure has the victim paste a command into the Windows Run dialog that starts cmd.exe and calls rundll32.exe to load a DLL directly from a WebDAV share over HTTPS, using a GUID-style directory and file names that imitate legitimate resources. Three variants were seen: a direct rundll32 call against the remote path, a pushd that maps the WebDAV share as a temporary drive before running rundll32, and a headless version run through conhost.exe –headless that hides the console and uses delayed environment-variable expansion to conceal pushd, rundll32 and the host name. ESET’s monitoring advice names rundll32 and WebDAV specifically. The detection logic is twofold: a registry rule on new RunMRU values (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU) containing rundll32 together with @SSL or a UNC path, pushd with a WebDAV path, or conhost –headless with rundll32; and a process rule for rundll32.exe whose command line references a \\host@SSL\ or mapped-drive DLL, especially when its ancestry is explorer.exe → cmd.exe or conhost.exe.

Use EDR registry and process telemetry with full command lines, plus WebClient service and outbound WebDAV (HTTP PROPFIND) activity from proxy logs. Microsoft’s blog includes an advanced hunting query built on this RunMRU logic; it is not reproduced here, so take the exact query text from the Microsoft post. Sweep 90 days, since stealers act fast but the paste event persists in RunMRU and is often the only trace of how the infection started. Allowlisting by process name is the wrong approach because rundll32 is always signed by Microsoft; anchor on the remote path and the Run-dialog origin instead. The detection generalizes well beyond ACR Stealer, since many ClickFix operators use the same WebDAV pattern. Treat any hit as an incident: the user ran attacker code, so isolate the host and rotate the user’s credentials and sessions rather than tuning.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.004 (User Execution: Malicious Copy and Paste); Defense Evasion → T1218.011 (System Binary Proxy Execution: Rundll32)

Sources: “ACR Stealer: Two observed intrusion chains amid increased threat activity”, Microsoft Security Blog, July 16, 2026, https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ (additional source); “Amatera: How the prolific infostealer works and spreads”, ESET, Oct. 29, 2026, https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/ (source article)

MSHTA Fetching Remote HTA From a Pasted Command

Microsoft’s second chain starts with a pasted command that launches mshta.exe against an HTA hosted on an attacker domain. The embedded VBScript uses COM objects to decode and start an encoded PowerShell payload, which generates a victim identifier, disables certificate validation, downloads a JPEG from an image-hosting service, extracts an encrypted and compressed payload hidden in the pixels, and loads shellcode reflectively after resolving LoadLibrary, GetProcAddress, VirtualAlloc, CreateThread and WaitForSingleObject at runtime. Microsoft notes the observed launches had PowerShell started from explorer.exe running mshta against an HTTPS URL ending in a seven-digit numeric path. The detection logic is a process rule for mshta.exe with an external http(s) URL on its command line whose parent is powershell.exe or cmd.exe under explorer.exe, and a follow-on rule for mshta.exe spawning powershell.exe with an encoded command.

Use EDR process creation with command lines and parent chains, and PowerShell script block logging (event 4104) to capture the decoded downloader. Sweep 90 days. Scope out the handful of legacy apps that legitimately run HTA by their local or intranet file paths, not by allowing mshta.exe as a process. Blocking the image-hosting service is usually the wrong control, since it is a public site employees use; detect the JPEG fetch by PowerShell instead, which is unusual. The ASR rule that blocks JavaScript and VBScript from launching downloaded executable content and application control on mshta.exe are better preventive controls. A confirmed mshta-to-PowerShell chain from a pasted command is a compromise and should be escalated, not tuned.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1218.005 (System Binary Proxy Execution: Mshta), T1027.003 (Obfuscated Files or Information: Steganography); Execution → T1059.001 (Command and Scripting Interpreter: PowerShell)

Sources: “ACR Stealer: Two observed intrusion chains amid increased threat activity”, Microsoft Security Blog, July 16, 2026, https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ (additional source)

Hidden Update Task Running Pythonw From Temp

After the WebDAV DLL runs, obfuscated PowerShell deploys an installer stage that downloads a ZIP, extracts it into a deceptive folder under %LocalAppData%\Temp (Microsoft’s example is “LogiOptionsPlus”), and runs a Python loader with a bundled pythonw.exe so no console appears. The same stage removes earlier deployments so it doubles as an updater, creates a hidden scheduled task disguised as a software update that runs at user sign-in, copies notepad.exe’s timestamps onto the dropped files, and clears PowerShell command history; ESET likewise advises watching for unusual scheduled tasks and cleared PowerShell history. Microsoft’s hunting logic looks for schtasks /run /tn launched by PowerShell where the task name contains “Autoupdate” and a numeric pattern. The detection logic combines a scheduled task creation (event 4698 or the TaskCache registry keys) whose action runs pythonw.exe from a path under %LocalAppData%\Temp, a schtasks /run issued by PowerShell, and deletion or truncation of ConsoleHost_history.txt in the user’s PSReadLine folder.

Use Windows security event 4698 and Task Scheduler operational logs, EDR process and file events, and file-creation timestamps compared with MFT or USN data to spot timestomping (files under Temp claiming notepad.exe’s build date). Sweep 90 days, because the logon task persists across reboots. Scope out developer workstations that legitimately use Python, but only by signed, installed interpreter paths; a pythonw.exe in Temp is not one of them. Hash-blocking the bundled pythonw.exe is the wrong control: it is the legitimate Python interpreter, so blocking its hash would break real installs, while the path and parentage catch the abuse. A hit should trigger host isolation and a check of the user’s browser-session tokens.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task); Execution → T1059.006 (Command and Scripting Interpreter: Python); Defense Evasion → T1036.004 (Masquerading: Masquerade Task or Service), T1070.006 (Indicator Removal: Timestomp), T1070.003 (Indicator Removal: Clear Command History)

Sources: “ACR Stealer: Two observed intrusion chains amid increased threat activity”, Microsoft Security Blog, July 16, 2026, https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ (additional source); “Amatera: How the prolific infostealer works and spreads”, ESET, Oct. 29, 2026, https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/ (source article)

Non-Browser Process Decrypting Browser Data, Then Staging Documents

Both chains end the same way. The injected payload, which in the first chain is handed execution through VirtualAlloc and the Fiber API (ConvertThreadToFiber, CreateFiber, SwitchToFiber) inside a system process, uses DPAPI to decrypt browser passwords, cookies and tokens from the Chromium Login Data and Web Data databases in Chrome and Edge, then enumerates PDFs, Microsoft 365 documents and files in OneDrive and SharePoint synced folders (Desktop and Downloads PDFs in the second chain) and archives them for exfiltration. In a subset of first-chain intrusions a secondary Python loader talks to public blockchain RPC endpoints and Web3 node services to read follow-on infrastructure from the ledger, which lets operators move C2 without redeploying. ESET confirms the same targets: browser credentials, cookies and session tokens and OneDrive or SharePoint-synced documents. The detection logic correlates, per host within a short window, a non-browser process opening Login Data, Web Data or Cookies under the Chrome or Edge user-data folder, a CryptUnprotectData (DPAPI) call from that same process, a burst of document reads across user and synced folders followed by creation of an archive in a temp location, and optionally an outbound connection to a blockchain RPC or Web3 node endpoint from pythonw.exe or a system process that has no wallet role.

This needs EDR file-access and API telemetry (or Windows SACL auditing on the browser database files), DPAPI audit events where available, and network telemetry with the initiating process, joined in a SIEM or EDR query engine. Build the allowlist from signed image paths of browsers, password managers, backup and sync agents and security tools, never from process names, since the payload runs inside legitimate system processes. Sweep 90 days and baseline normal blockchain RPC use first, since developer and finance machines may use it legitimately. The detection generalizes to most infostealers, not just Amatera, and pairs well with the ClickFix leads above to raise confidence. Any confirmed hit means the user’s sessions are compromised: revoke tokens and sessions, reset passwords and rotate any secrets stored in the browser or synced folders, because resetting the password alone leaves stolen session cookies valid.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1555.003 (Credentials from Password Stores: Credentials from Web Browsers); Collection → T1005 (Data from Local System), T1074.001 (Data Staged: Local Data Staging); Defense Evasion, Privilege Escalation → T1055 (Process Injection); Command and Control → T1102.001 (Web Service: Dead Drop Resolver)

Sources: “ACR Stealer: Two observed intrusion chains amid increased threat activity”, Microsoft Security Blog, July 16, 2026, https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ (additional source); “Amatera: How the prolific infostealer works and spreads”, ESET, Oct. 29, 2026, https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/ (source article)

Hash Appendix

Amatera / ACR Stealer

Neither the ESET source article nor Microsoft’s ACR Stealer write-up publishes file hashes; AlienVault OTX and VirusTotal were not queried in this run, so no hashes are listed. Detect on the paths, task names, parentage and infrastructure above. The bundled pythonw.exe dropped into %LocalAppData%\Temp is the legitimate Python interpreter: blocking its hash would break legitimate Python installs.

MD5s
(not available)  # Amatera / ACR Stealer payloads -> no hashes published by the sources

SHA1s
(not available)  # Amatera / ACR Stealer payloads -> no hashes published by the sources

SHA256s
(not available)  # Amatera / ACR Stealer payloads -> no hashes published by the sources

References Appendix

• “Amatera: How the prolific infostealer works and spreads”, ESET WeLiveSecurity (Mario Micucci), Oct. 29, 2026, https://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/ (source article; lineage, MaaS model, distribution, targets, monitoring advice)
• “ACR Stealer: Two observed intrusion chains amid increased threat activity”, Microsoft Security Blog (Microsoft Security Research, Balaji Venkatesh S), July 16, 2026, https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ (additional source; both intrusion chains, domains, hunting logic)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/