Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix. eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to […]Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix. eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to […]

Hackers target crypto wallets, browser data in fake reCAPTCHA pop-up campaign

Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix.

eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to the TRU, threat actors use the method to socially engineer victims into running malicious commands manually through the Windows Run prompt. 

Once executed, those commands launch an infection chain that ends with the deployment of Amatera Stealer and NetSupport RAT, both legitimate remote monitoring tools that have been repurposed by cybercriminals for unauthorized remote access.

ClickFix campaign uses reCAPTCHA to sneak malware in

Per eSentire’s research published last Thursday, hackers are luring victims using fake websites and pop-ups that look like “security checks,” including fraudulent reCAPTCHA verification boxes and counterfeit Cloudflare Turnstile pages. 

The deceptive interfaces prompt users to “fix” a supposed issue, with the instructions causing them to execute harmful commands without seeing the risks. Once the initial command is run, Amatera Stealer is delivered first, followed by the installation of NetSupport Manager, which allows hackers to monitor and control the compromised machine as though they were physically present.

Amatera Stealer is not an entirely new threat but the latest evolution of ACR Stealer, also known as AcridRain. The earlier version first appeared as a malware-as-a-service product on hacker forums in 2024, which several users deployed through subscription packages.

Sales of ACR were paused in mid-2024 when its developer, known online as SheldIO, sold the malware’s source code. Despite the sale announcement, the group said it was “not the end” of its development. Researchers now believe Amatera is the direct successor to ACR, rebuilt with more capabilities and new evasion techniques.

Amatera, spotted by security auditing firm Proofpoint in June, is available on a subscription basis from $199 per month to $1,499 annually.

“Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services. It employs advanced evasion strategies like WoW64 SysCalls to circumvent user-mode hooking mechanisms used by sandboxes, Anti-Virus solutions, and EDR products,” eSentire said.

The malware is written in C++ and is capable of harvesting saved passwords, card details, browsing histories, and files from browsers like Chrome, Brave, Edge, Opera, Firefox, and specialized platforms such as Tor Browser and Thunderbird. 

Multi-stage Windows PowerShell loaders hiding malware

According to eSentire’s threat analysis, the Amatera’s infection process is built on several layers of obfuscated PowerShell commands. 

TRU researchers saw one phase decrypting subsequent payloads using an XOR process on the string “AMSI_RESULT_NOT_DETECTED,” a term associated with Microsoft’s Anti-Malware Scan Interface. The loader’s developer could have selected the phrase intentionally to confuse researchers conducting dynamic analysis.

While Amatera is the most common payload delivered in these campaigns, eSentire also documented cases where the same loader was used to deploy other infostealers, including Lumma and Vidar. Some samples lacked configuration parameters needed to run multi-stage loaders, in which hackers chose to deploy NetSupport Manager directly instead.

eSentire and other security firms have documented email campaigns distributing Visual Basic Script files disguised as invoices. When opened, the files executed batch scripts that initiated PowerShell loaders delivering XWorm.

Other campaigns involved compromised websites that redirected visitors to fake Cloudflare verification pages, which mimic ClickFix prompts. This activity has been tied to an operation known by names including SmartApeSG, HANEYMANEY, and ZPHP, all coming with NetSupport RAT as their final payload.

Hackers had built fraudulent Booking.com websites that hosted counterfeit CAPTCHA checks, instructing users to open the Windows Run dialog and execute a command, and directly installing a credential-stealing script onto infected systems.

Some of the phishing campaigns connected to these malware deliveries are using a new phishing kit known as Cephas. Cephas, according to cybersecurity solutions firm Barracuda, uses an advanced obfuscation method that inserts invisible characters into the source code of phishing pages, difficult for automated scanners to detect.

“The kit obscures its code by creating random invisible characters within the source code that help it evade anti-phishing scanners and obstruct signature-based YARA rules from matching the exact phishing methods,” Barracuda wrote in its analysis last week.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.

Market Opportunity
Zypher Network Logo
Zypher Network Price(POP)
$0.0006807
$0.0006807$0.0006807
+6.29%
USD
Zypher Network (POP) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact service@support.mexc.com for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Momentum Check: Can XDC Network Charge Back to Its Recent Highs, or Is a Pullback in Play?

Momentum Check: Can XDC Network Charge Back to Its Recent Highs, or Is a Pullback in Play?

The crypto market’s prolonged bearish fear is gaining more traction day by day, which has pulled down the total market cap toward $2.95 trillion. Meanwhile, most
Share
Thenewscrypto2025/12/27 15:21
Ondo Plans Tokenized U.S. Stocks and ETFs on Solana in 2026 After Low-Slippage Tests

Ondo Plans Tokenized U.S. Stocks and ETFs on Solana in 2026 After Low-Slippage Tests

The post Ondo Plans Tokenized U.S. Stocks and ETFs on Solana in 2026 After Low-Slippage Tests appeared on BitcoinEthereumNews.com. Ondo Finance plans to launch
Share
BitcoinEthereumNews2025/12/27 19:39
Vitalik Buterin Reveals Ethereum’s Bold Plan to Stay Quantum-Secure and Simple!

Vitalik Buterin Reveals Ethereum’s Bold Plan to Stay Quantum-Secure and Simple!

Buterin unveils Ethereum’s strategy to tackle quantum security challenges ahead. Ethereum focuses on simplifying architecture while boosting security for users. Ethereum’s market stability grows as Buterin’s roadmap gains investor confidence. Ethereum founder Vitalik Buterin has unveiled his long-term vision for the blockchain, focusing on making Ethereum quantum-secure while maintaining its simplicity for users. Buterin presented his roadmap at the Japanese Developer Conference, and splits the future of Ethereum into three phases: short-term, mid-term, and long-term. Buterin’s most ambitious goal for Ethereum is to safeguard the blockchain against the threats posed by quantum computing.  The danger of such future developments is that the future may call into question the cryptographic security of most blockchain systems, and Ethereum will be able to remain ahead thanks to more sophisticated mathematical techniques to ensure the safety and integrity of its protocols. Buterin is committed to ensuring that Ethereum evolves in a way that not only meets today’s security challenges but also prepares for the unknowns of tomorrow. Also Read: Ethereum Giant The Ether Machine Takes Major Step Toward Going Public! However, in spite of such high ambitions, Buterin insisted that Ethereum also needed to simplify its architecture. An important aspect of this vision is to remove unnecessary complexity and make Ethereum more accessible and maintainable without losing its strong security capabilities. Security and simplicity form the core of Buterin’s strategy, as they guarantee that the users of Ethereum experience both security and smooth processes. Focus on Speed and Efficiency in the Short-Term In the short term, Buterin aims to enhance Ethereum’s transaction efficiency, a crucial step toward improving scalability and reducing transaction costs. These advantages are attributed to the fact that, within the mid-term, Ethereum is planning to enhance the speed of transactions in layer-2 networks. According to Butterin, this is part of Ethereum’s expansion, particularly because there is still more need to use blockchain technology to date. The other important aspect of Ethereum’s development is the layer-2 solutions. Buterin supports an approach in which the layer-2 networks are dependent on layer-1 to perform some essential tasks like data security, proof, and censorship resistance. This will enable the layer-2 systems of Ethereum to be concerned with verifying and sequencing transactions, which will improve the overall speed and efficiency of the network. Ethereum’s Market Stability Reflects Confidence in Long-Term Strategy Ethereum’s market performance has remained solid, with the cryptocurrency holding steady above $4,000. Currently priced at $4,492.15, Ethereum has experienced a slight 0.93% increase over the last 24 hours, while its trading volume surged by 8.72%, reaching $34.14 billion. These figures point to growing investor confidence in Ethereum’s long-term vision. The crypto community remains optimistic about Ethereum’s future, with many predicting the price could rise to $5,500 by mid-October. Buterin’s clear, forward-thinking strategy continues to build trust in Ethereum as one of the most secure and scalable blockchain platforms in the market. Also Read: Whales Dump 200 Million XRP in Just 2 Weeks – Is XRP’s Price on the Verge of Collapse? The post Vitalik Buterin Reveals Ethereum’s Bold Plan to Stay Quantum-Secure and Simple! appeared first on 36Crypto.
Share
Coinstats2025/09/18 01:22