Loading story…
A phishing campaign delivered the Amadey malware through a Spanish-language email carrying an archive named AVISO.001, which contained a PE executable. After execution, the malware profiled the infected host, copied itself into ProgramData for persistence, and modified the HKCU User Shell Folders\Startup registry value to maintain access. Reporting on Amadey has also described it as a bot targeting primarily non-Russian users, underscoring its role as a broadly deployed crimeware platform.
The sample contacted command-and-control infrastructure at 176.111.174.67 and downloaded two DLL modules that were executed with rundll32.exe. One module, cred.dll, harvested credentials from applications including Outlook, FileZilla, and Pidgin/Purple, while scr.dll captured screenshots for exfiltration. Stolen host metadata and collected data were sent to /7Ndd3SnW/index.php, and an exposed control panel reportedly showed 461 screenshots, indicating multiple active victims and ongoing credential and surveillance theft.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The researcher observed an exposed Amadey command-and-control panel and found 461 screenshots stored on the server. This indicated the campaign had already compromised multiple victims and was actively collecting screenshot data.
During the analyzed infection, the Amadey payload downloaded two DLL modules, cred.dll and scr.dll, from its command-and-control server at 176.111.174.67 and executed them via rundll32.exe. The cred.dll module harvested credentials from applications including Outlook, FileZilla, and Pidgin/Purple, while scr.dll captured and exfiltrated screenshots.
SANS ISC analyzed a phishing-delivered Amadey infection in which a Spanish-language email carried an archive named "AVISO.001" containing a PE executable. The sample profiled the victim host, copied itself into ProgramData for persistence, and modified the HKCU User Shell Folders Startup registry value.
BlackBerry published a threat spotlight on the Amadey bot, documenting the malware family and its targeting of non-Russian users. This establishes prior public reporting on Amadey before the later SANS analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Amadey** has evolved from an information-stealing bot into a broader malware delivery platform, with newer variants adding screenshot capture, expanded credential theft, clipboard hijacking, and delivery of follow-on payloads such as **Remcos RAT**, **RedLine Stealer**, and **LockBit 3.0**. Recent analyses said the malware is being distributed through multiple channels including the **RIG Exploit Kit**, phishing emails, fake software installers, torrent-distributed cracks and keygens, malicious Office documents, and gaming cheat sites. Once executed, Amadey typically profiles the host, checks for security products, establishes persistence through registry changes, scheduled tasks, or startup-folder abuse, and communicates with command-and-control servers over plain HTTP to fetch plugins and additional malware. Multiple reports said Amadey operators are using modular DLL components such as `cred.dll`, `scr.dll`, `clip64.dll`, and newer credential-stealing plugins to harvest browser, remote access, FTP, Outlook, and MikroTik data while also capturing screenshots and replacing cryptocurrency wallet addresses in the clipboard. Long-term infrastructure tracking found hundreds of active Amadey C2 servers and thousands of secondary payloads, showing that the malware has become a durable **loader-as-a-service** platform with ties to overlapping criminal campaigns. Analysts also observed delivery chains involving SmokeLoader and Nitol, abuse of public-interest lures such as fake KakaoTalk updates, and continued use of Amadey to stage ransomware and remote-access infections on compromised Windows systems.
Aug 15, 2026
Researchers reported an active campaign distributing **Amatera Stealer** by using fake “human verification”/CAPTCHA pages (often described as *ClickFix*) to trick users into manually pasting and running a command via the Windows **Run** dialog. Instead of launching PowerShell directly, the command abuses the signed Microsoft App-V script `SyncAppvPublishingServer.vbs` to proxy PowerShell execution through trusted Windows components (e.g., `wscript.exe`), helping the activity blend in with legitimate tooling and evade some defenses. On suitable targets—systems where **Application Virtualization (App-V)** is present and enabled (notably Windows 10/11 Enterprise/Education and modern Windows Server)—the infection chain performs anti-analysis checks to hinder sandbox detonation, then pulls staging/configuration data from a public **Google Calendar** (`.ics`) resource. Additional stages are retrieved using **steganography**, including encrypted payloads embedded in PNG images hosted on public infrastructure/CDNs, which are then decrypted and executed in memory to deliver Amatera (described as based on **ACR Stealer** and offered as **malware-as-a-service**). Recommended mitigations highlighted include tightening controls around Run-dialog execution, disabling unnecessary App-V components, increasing PowerShell/script logging visibility, and monitoring for anomalous outbound retrievals to calendar/image-hosting services.
Jun 29, 2026
Trellix reported that threat actors used a compromised or abandoned self-hosted GitLab instance at `gitlab.bzctoons.net` to distribute the **StealC** infostealer through the **Amadey** loader. The campaign relied on trusted-looking infrastructure on the long-registered `bzctoons.net` domain and valid TLS certificates to make payload delivery appear legitimate and reduce suspicion. After infecting a host, Amadey enforced single-instance execution with a mutex, copied itself into `Temp` and `AppData` locations, used custom Base64-like string obfuscation, and communicated with command-and-control infrastructure over HTTP using RC4-encrypted traffic to `91.92.243.129`. Once it profiled the victim, Amadey downloaded a clipper plugin executed through `rundll32.exe`, then retrieved `protected.zip` from the GitLab repository and extracted **StealC** as `x64_protect.exe`. StealC subsequently contacted its own C2 server at `158.94.208.130`, while Amadey established persistence with scheduled tasks including `C:\Windows\Tasks\Yfgfwb.job`. The activity shows how attackers continue to weaponize legitimate development platforms for multi-stage malware delivery and credential theft.
Jun 29, 2026