Cybersecurity experts have found malware campaigns that use Amatera Stealer and NetSupport RAT through the now-common ClickFix social engineering technique.
This month, eSentire is monitoring the activity under the name EVALUSION.
Amatera, which was first discovered in June 2025, is thought to be a development of ACR (short for “AcridRain”) Stealer, which was offered under the malware-as-a-service (MaaS) model until its sales were halted in mid-July 2024. Subscription prices for Amatera range from $199 per month to $1,499 for a year.
According to the Canadian cybersecurity provider Amatera, threat actors can target crypto-wallets, browsers, messaging apps, FTP clients, and email services with its comprehensive data exfiltration capabilities.
Notably, Amatera uses sophisticated evasion strategies including WoW64 SysCalls to get beyond user-mode hooking mechanisms that are frequently employed by EDR products read more about New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.