ESET details Amatera infostealer spread, capabilities, and MaaS model
Sold from $199 a month, it led ESET’s Latin America infostealer detections in the first half of 2026.
58
Malware
Amatera
- Mentions · 7d1
- Mentions · 30d1
- All mentions7
- First seenAug 24, 2026
- Last mentioned1d ago
Timeline
7 articles · newest firstClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
62
Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware
Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.
55
Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories
Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.
58
Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data
Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.
62
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
55
Foul Language: WordlistLoader Disguises Malware as Ordinary Text
ClickFix-style campaigns deploy WordlistLoader, which disguises malware as ordinary text, to deliver the increasingly prevalent Amatera infostealer.
50
Appears with
- Cisco Talosvendor · 3
- Ukrainian government organizationvictim · 3
- ZigCryptoStealermalware · 3
- UAT-10820threat actor · 3
- APEX Stealermalware · 2
- Remusmalware · 2
- Cloudflare Workersproduct · 2
- CallbackBeavermalware · 2
- Clineproduct · 2
- NetSupport Managerproduct · 2
- Claudeproduct · 2
- Continueproduct · 2
- OpenCodeproduct · 2
- STG Stealermalware · 2
- ClearFakemalware · 2
- Gen Digitalvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.