ESET details Amatera infostealer spread, capabilities, and MaaS model
Original title: Amatera: How the prolific infostealer works and spreads
Sold from $199 a month, it led ESET’s Latin America infostealer detections in the first half of 2026.
ESET describes Amatera, detected as Win/PSW.Amatera, as a C++ Windows infostealer sold as malware-as-a-service and very likely a rebrand of ACR Stealer, itself linked to GrMsk. Affiliates pay for the panel and choose delivery, including ClickFix, malicious ads, phishing, and compromised sites. It steals browser secrets, synced files, and cryptocurrency wallet data. It led ESET’s Latin America infostealer detections in the first half of 2026.
Unconfirmed: ESET says Amatera is very likely, not confirmed, a rebrand of ACR Stealer.
- ESET first observed Amatera in 2024 and detects it as Win/PSW.Amatera.
- By the end of 2024 it was offered for $199 a month with Telegram support.
- Straiker reported clipboard manipulation aimed at cryptocurrency wallet data.
- ClickFix variants include AI-fix, CrashFix, and ConsentFix OAuth-token theft.
- ClickFix detections more than doubled in the first half of 2026 after a late-2025 drop.
Impact: Theft of credentials, cookies, tokens, files, and crypto-wallet data
- Malware
- AmateraACR StealerGrMsk
From the original article
6 min read at welivesecurity.comThe malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cybercrime has professionalized
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.