Amatera infostealer spreads via ClickFix and fake AI tool ads, ESET reports

What happened

According to ESET WeLiveSecurity, Amatera is a Windows infostealer written in C++. ESET says it was first observed in 2024, is sold as malware-as-a-service and topped ESET’s infostealer detections in Latin America in the first half of 2026, while targeting victims worldwide. These findings come from a single vendor report. No independent verification is included in the sources.

ESET says Amatera is very likely a rebrand of ACR Stealer, based on code similarities, and that by the end of 2024 it was offered for $199 a month with support via Telegram (ESET WeLiveSecurity).

According to ESET, the malware steals:

• Browser credentials, cookies, browsing history, form data and session tokens.
• Crypto wallet data.
• Messaging data and files, including documents synced with OneDrive or SharePoint.
• Secrets from development environments.

ESET also cites Straiker research that the malware went after cryptocurrency wallet data by manipulating the clipboard (ESET WeLiveSecurity).

ESET reports these delivery methods:

• Compromised websites, including legitimate WordPress sites.
• Search engine ads and SEO poisoning.
• Targeted emails, fake documents and SVG files.
• ClickFix lures. These include fake CAPTCHAs and variants ESET calls AI-fix, CrashFix and ConsentFix.

ESET cites Straiker as finding dozens of fake install pages promoted through paid ads and SEO poisoning. According to that research, the pages impersonated AI and developer tools such as Claude Code, NotebookLM, JetBrains, Comet and Snowflake (ESET WeLiveSecurity).

Victim counts and specific indicators of compromise are not confirmed in the source.

Am I affected?

• Windows users: ESET describes Amatera as Windows malware. ESET products detect it as Win/PSW.Amatera (ESET WeLiveSecurity).
• Anyone who followed copy-and-run instructions: this covers commands copied from a web page, fake CAPTCHA, browser error or “fix” prompt into Run, PowerShell or Terminal.
• Developers who installed tools from ad links: ESET reports that fake install pages for AI and developer tools were promoted through ads and SEO poisoning, and specifically targeted developers who use AI tools.
• Employers of affected users: ESET notes the risk spreads to employers when personal and work profiles share one browser.
• Indicators: no file hashes, domains or other IOCs are provided in the source. These are not confirmed.

What to do now

1. Never paste commands from a web page into Run, PowerShell or Terminal. ESET says no legitimate CAPTCHA, error message or installation guide asks for this, and an ad is no guarantee a site is official (ESET WeLiveSecurity).
2. Install AI and developer tools only from the vendor’s official site. Avoid search ad links.
3. Apply application control and limit the use of system interpreters and binaries outside their normal context, as ESET recommends.
4. Monitor these activities, which ESET lists:
   • PowerShell and Rundll32 use.
   • WebDAV activity.
   • Unusual scheduled tasks.
   • Clearing of PowerShell history.
5. Use phishing-resistant authentication, keep browser sessions short and separate personal and work browser profiles. Avoid storing secrets in the browser when a managed alternative exists.
6. If a compromise is confirmed, isolate the device. Then, from a trusted device:
   • Revoke active sessions and reset passwords.
   • Rotate API keys, tokens, SSH credentials and other secrets that were on the system.
   • Review access to email, cloud services, repositories and financial applications.
   • Look for follow-on activity beyond the first host (ESET WeLiveSecurity).

Sources

• ESET WeLiveSecurity: Amatera: How the prolific infostealer works and spreads