Amatera Infostealer Dominates Latin America, Showcasing Cybercrime Professionalization
The Amatera infostealer, a sophisticated malware-as-a-service, has become a leading threat in Latin America, highlighting the growing professionalization of cybercrime operations.
Amatera, a prolific infostealer that topped ESET's detection charts in Latin America during the first half of 2026, exemplifies the increasing professionalization within the cybercrime landscape. This malware-as-a-service (MaaS) model sees developers maintaining the core product, control panel, and support infrastructure, while affiliates pay a subscription fee to launch their own campaigns.
First observed in 2024 and written in C++, Amatera is believed to be a rebrand or updated version of the ACR Stealer, which itself evolved from the GrMsk stealer. This practice of rebranding or releasing updated versions under new names is common in the MaaS ecosystem, often serving as a business strategy to evade tracking or refresh offerings. By the end of 2024, Amatera Stealer was reportedly available for a monthly subscription of $199, with support provided via Telegram.
Amatera's capabilities are extensive, targeting a wide array of sensitive data. It extracts credentials, session cookies, and tokens from web browsers, and can also search for and exfiltrate sensitive documents and files synced with cloud storage services like OneDrive and SharePoint. The malware also targets cryptocurrency wallet data by manipulating the clipboard, posing a significant threat to digital assets. This broad scope makes Amatera a lucrative tool for cybercriminals, enabling account hijacking, financial fraud, and access into victim organizations.
The distribution methods for Amatera are varied and constantly evolving, reflecting the flexibility of the MaaS model. Affiliates employ diverse attack chains, including compromised websites, malicious search engine ads, targeted phishing emails, and deceptive documents. A particularly prevalent delivery vector is the "ClickFix" technique, a social engineering method that tricks victims into executing malicious commands by presenting fake CAPTCHA checks or browser error messages.
Recent variations of ClickFix include "AI-fix," which impersonates legitimate AI services with fake troubleshooting content; "CrashFix," which simulates browser crashes to push malicious "quick fixes"; and "ConsentFix," which tricks users into granting OAuth tokens, compromising their Microsoft accounts without requiring passwords. These campaigns have also leveraged compromised WordPress sites, exploiting weak credentials or vulnerabilities in themes and plugins.
In Latin America, Amatera significantly outpaced other infostealers like Formbook, Vidar, and Lumma Stealer in early 2026. Globally, ClickFix's detection rates have shown considerable fluctuation, with a substantial increase in late 2025 followed by a doubling in early 2026 as attackers adapted the technique. Amatera affiliates also utilize paid Google ads, promoting fake install pages that impersonate popular AI and developer tools to target professionals.
The consequences of an Amatera compromise can be severe, ranging from identity theft and financial loss to corporate network breaches. The malware's continuous development and the adaptability of its distribution tactics underscore the persistent and evolving threat it poses to both individuals and organizations worldwide.