Amatera: How the prolific infostealer works and spreads

Infostealers have evolved into a professionalized business model where developers maintain the core product and affiliates pay subscriptions to use it in campaigns, exemplified by Amatera. The malware extracts data such as login credentials, session cookies, tokens, cryptocurrency wallet information, messaging data, files, and development secrets. This capability makes infostealers a significant threat for account hijacking, financial fraud, and corporate intrusion.
Amatera functions under a malware-as-a-service (MaaS) model, with developers maintaining the code and infrastructure while affiliates manage distribution. The malware leverages various delivery vectors, including compromised websites, search engine ads, targeted emails, fake documents, SVG files, and social engineering techniques like ClickFix. Attackers often use these methods to trick victims into executing commands, leading to compromises that can extend beyond the initial infection to include accessing cloud storage or code repositories.
The threat landscape is characterized by the continuous adaptation of delivery methods; for instance, ClickFix has evolved into variants like AI-fix and CrashFix, which exploit social engineering principles by impersonating legitimate services or triggering fake errors. This evolution demonstrates a rapid pace at which malicious toolsets are adapted to new environments, impacting detection rates and response strategies across different regions.

* Amatera is a Windows infostealer written in C++ first observed in 2024.
* Amatera operates under the malware-as-a-service (MaaS) model.
* Developers maintain the code, control panel, and support infrastructure for Amatera.
* Affiliates pay subscriptions to use the malware in campaigns.
* Amatera extracts credentials, cookies, browsing histories, form data, session tokens, cryptocurrency wallet information, messaging data, files, and secrets from development environments.
* Amatera can search for and extract sensitive documents synced with OneDrive or SharePoint.
* The malware has been distributed via compromised websites, search engine ads, targeted emails, fake documents, SVG files, and ClickFix via fake CAPTCHAs.
* ClickFix variants include AI-fix (impersonating AI services), CrashFix (fake browser crashes), and ConsentFix (tricking victims into handing over OAuth tokens).
* Amatera affiliates purchase Google ads to promote fake install pages impersonating tools like Claude Code, NotebookLM, JetBrains, Comet, and Snowflake.
* In the first half of 2026, Amatera topped ESET’s infostealer detections in Latin America.
* Detection rates for ClickFix jumped by over 500% in the first half of 2025 compared to the previous six months.
* Potential consequences include compromise of accounts, theft of crypto assets, infrastructure compromise via SSH keys or FTP credentials, and installation of additional malware.

The narrative highlights a shift in cybercrime from simple malware distribution to sophisticated service-based ecosystems. The professionalization seen in the infostealer market, where development, distribution, and monetization are separated into distinct roles (developers, affiliates), demonstrates a mature adversarial infrastructure built around a MaaS approach. This structure allows for rapid iteration and adaptation, evidenced by the constant rebranding of tools like Amatera and the evolution of delivery methods like ClickFix variants.
The emphasis on social engineering vectors, particularly the ClickFix family, reveals a pattern where exploiting human trust (through mimicking AI services or error messages) becomes a primary mechanism for initial access, bypassing technical security controls. The consequence is not just the immediate theft of data but the persistent risk that stolen credentials and session tokens become long-term leverage, capable of enabling subsequent lateral movement into enterprise systems.
The risk compounds when this ecosystem intersects with organizational realities; the potential exposure stems from the conflation of personal and corporate identities in a single environment. The defense strategy must recognize that stopping at device isolation is insufficient because the compromise is systemic—the stolen assets can be leveraged later by other actors, meaning the focus needs to shift from remediation to comprehensive session revocation and credential rotation across all interconnected services.
Bridge Questions: How does the reliance on public platforms for distribution affect the viability of security measures implemented within closed enterprise networks? What are the systemic vulnerabilities created when trust in AI impersonation is weaponized as an initial attack vector? If attackers prioritize long-term persistence through stolen credentials, how can organizations implement controls that render ephemeral session tokens less valuable to external actors?