New Phishing Campaign Impersonates Ukrainian Police to Deliver Amatera Stealer and PureMiner

A new phishing campaign, observed by FortiGuard Labs, impersonates the National Police of Ukraine in an SVG-based lure designed to deliver Amatera Stealer and PureMiner. The attack starts with forged emails claiming to be a notice from Ukrainian police, containing a malicious SVG attachment that, once opened, loads a spoofed Adobe Reader interface and prompts the user to download a password‑protected archive.

The archive houses a CHM file that runs a hidden HTA resource via a remote HTML Application, triggering CountLoader to gather system information and contact a remote server with an HTTP POST before requesting further commands. FortiGuard notes that the delivered archives include ergosystem[.]zip, which uses DLL sideloading to install PureMiner, a stealthy .NET cryptominer that checks memory and GPU capabilities before mining and communicates over an encrypted 3DES channel.

Another archive, smtpB[.]zip, carries a Python interpreter and script that loads Amatera Stealer directly into memory, enabling extensive data harvesting from both Gecko- and Chromium-based browsers, including credentials, cookies, and crypto-wallet extensions, as well as from applications such as Steam, Telegram, FileZilla and AnyDesk. The operation highlights how SVG phishing is being used to facilitate fileless infections and multi‑stage payloads.