ESET details Amatera infostealer spread, capabilities, and MaaS model
Sold from $199 a month, it led ESET’s Latin America infostealer detections in the first half of 2026.
1
Stories per day · 30 days
3 RSS
Relatedamatera1clickfix1credential-theft1group-ib1infostealer1keylogger1kgb-rat1latin-america1njrat1rat1
24 stories, newest first · one card per story
Stories tagged #malware-as-a-service
KGB RAT Malware Bypasses Windows Defender to Steal Credentials and Control PCs
Group-IB analyzed KGB RAT, a malware-as-a-service trojan based on NjRAT that steals credentials and controls PCs.
Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats
Gen Digital details Warden Stealer, a Rust MaaS infostealer spread via ClickFix, malvertising, cracked software, and fake game cheats stealing browser, wallet, and AI tokens.
5
Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer, a Rust malware-as-a-service, harvests tokens and prompts from Claude, Codex, Grok, and Cursor.
8
New Infostealer Can Steal Passwords, Cards, Cookies and Wi-Fi Keys From Windows PCs
K7 Labs analyzed a Python infostealer builder that steals Windows browser secrets, cards, cookies, Discord tokens, and Wi-Fi passwords.
3
RATHat Android Malware Uses Gemini AI to Control Phones Outside Normal App Permissions
RATHat Android banking trojan uses Gemini to pair wireless debugging and control phones beyond normal app permissions.
Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks
Cleafy's RATHat Android trojan uses Gemini Flash to navigate UIs and keeps shell persistence after app removal.
1
RatHat's Evolving C2 Panel Points to Malware-as-a-Service Model
Cleafy details RatHat Android banking trojan's C2 panel evolving into a Gemini-powered malware-as-a-service platform that ranks victims by estimated bank balance.
RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims
Cleafy details RatHat Android banking trojan's malware-as-a-service console, which uses Google Gemini to rank victims by bank balance and guide on-device taps.
Python MaaS Infostealer Builder Steals Passwords, Credit Cards and Cookies From 17 Browsers
K7 Labs analyzed a Python malware-as-a-service builder that steals browser passwords, cards, and cookies from 17 Chromium browsers.
2
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details LunexStealer MaaS using BYOVD with AMD's PDFWKRNL.sys (CVE-2023-20598) to blind EDR before stealing credentials and crypto wallets.
2
New Android malware RemControl steals banking PINs and blocks removal attempts
Group-IB says RemControl, a new Android banking trojan, steals PINs from customers of more than 30 banks.
4
RemControl Android Malware Targets 30+ Banking Apps to Steal PINs and Credentials
RemControl Android trojan overlays 30-plus banking apps, stealing PINs and streaming screens through accessibility abuse.
3
.jpg&w=828&q=75)
New RemControl Android banking malware targets users in Europe and Canada
New RemControl Android banking MaaS steals credentials via 30+ phishing overlays targeting Europe, Canada, and the Middle East.
3
Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools
GitHub-based LastPass impersonation distributed 'Rapuncel' infostealer using a signed driver to kill 145 security tools.
3
New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code
Sekoia says the Exvicy ClickFix malware service reuses ErrTraffic code and delivers payloads via WordPress.
New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
3
Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs
SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.
VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems
New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.
VectraRAT Can Hack Windows Enterprises for $250 per Month
VectraRAT malware-as-a-service sells a Windows implant with C2 infrastructure and operator panel for $250 per month.
VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch
SOCRadar's Threat Research Unit documents VectraRAT, a previously unreported full-stack Malware-as-a-Service platform built entirely from scratch.
Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware
Attackers distribute MacSync macOS infostealer via fake Claude and ChatGPT installers and sponsored search ads, stealing passwords, cookies, keys, and wallets.
2
Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.
ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.
1
Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown
McAfee says WeedHack infostealer MaaS still spreads via ten fake Minecraft client sites and SEO poisoning despite C2 takedown, with 116,464 infections logged.
2