New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT

According to eSentire, cybersecurity researchers have spotted a new EVALUSION campaign using the ClickFix social-engineering lure to deliver Amatera Stealer and NetSupport RAT. The activity was observed this month and tracked by eSentire under the moniker EVALUSION, with first spotting dating back to June 2025.

Amatera is described as an evolution of the ACR Stealer, offered as a MaaS product with subscription plans running from $199 per month to $1,499 for a year, and it provides extensive data exfiltration targeting crypto-wallets, browsers, messaging apps, FTP clients, and email services, employing evasion techniques such as WoW64 SysCalls to bypass sandboxing and EDR tools.

The campaign uses a Windows Run dialog phishing flow to trigger a reCAPTCHA check on bogus pages, then initiates a multi-step process that launches mshta.exe to execute a PowerShell script, which downloads a .NET component from MediaFire. The Amatera DLL, packed with PureCrypter (advertised by a threat actor named PureCoder as MaaS), is injected into MSBuild.exe, after which NetSupport RAT is downloaded unless the PowerShell check finds the machine to be domain-joined or containing valuable files.