Amatera Stealer is information-stealing malware, evolved from ACR Stealer, that harvests credentials and data via ClickFix and malvertising campaigns.
Cato Networks says a sponsored ad outranked OpenAI's own page, sending macOS developers to a Google Sites portal whose ClickFix content lives on infrastructure Google never hosted.
Perspective Coverage
3 publishersReality
Hudson Rock and ADAMnetworks link the ads to an operation they call PasteSwitch, which hands Windows and macOS visitors different paste-this-command lures and swaps payloads on the backend depending on who arrives.
Perspective Coverage
5 publishersReality
The Threat Source newsletter's author spent the summer in trauma literature from medicine, first response and the military, and came back with four separate conditions that cybersecurity's one word merges into a single problem with a single fix.
Reality
Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.
Reality
SOCRadar says two previously unreported RATs pull their next-stage commands out of FTP greetings. It is a first in the wild, and noisier than the web dead drops it replaces.
Reality
Malwarebytes traces one loader through ClickFix prompts, malicious game installs and fake software downloads. The shared part is a .csproj-to-MSBuild handoff and a blockchain lookup for C2.
Reality