Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory

On 18 November 2025, security researchers disclosed a widespread malware operation that uses the ClickFix social-engineering technique to deploy a rebranded version of AcridRain (ACR) Stealer, now called Amatera Stealer, alongside NetSupport RAT. According to eSentire’s Threat Response Unit (TRU), the campaign combines social manipulation, multi-stage PowerShell payloads, AMSI evasion, and extensive credential theft capabilities.

The initial access vector via ClickFix convinces victims to run commands in the Windows Run Prompt, triggering a PowerShell chain that includes a stage that uses XOR against the string “AMSI_RESULT_NOT_DETECTED” to decrypt the next payload. The malware then patches Windows security functions in memory by overwriting the AmsiScanBuffer reference, disabling AMSI during subsequent script execution.

One loader stage is a .NET downloader packed with Agile[.]net that retrieves an encrypted payload from MediaFire and decrypts it, after which a Pure Crypter-packed DLL unpacks and executes Amatera Stealer. Once installed, Amatera harvests data from browsers, cryptocurrency wallet extensions, password managers, desktop wallets, FTP/email/VPN clients, and other applications, with a capability set that includes 149+ cryptocurrency extensions and 43+ password managers.