Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix. eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to […]Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix. eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to […]

Hackers target crypto wallets, browser data in fake reCAPTCHA pop-up campaign

Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix.

eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to the TRU, threat actors use the method to socially engineer victims into running malicious commands manually through the Windows Run prompt. 

Once executed, those commands launch an infection chain that ends with the deployment of Amatera Stealer and NetSupport RAT, both legitimate remote monitoring tools that have been repurposed by cybercriminals for unauthorized remote access.

ClickFix campaign uses reCAPTCHA to sneak malware in

Per eSentire’s research published last Thursday, hackers are luring victims using fake websites and pop-ups that look like “security checks,” including fraudulent reCAPTCHA verification boxes and counterfeit Cloudflare Turnstile pages. 

The deceptive interfaces prompt users to “fix” a supposed issue, with the instructions causing them to execute harmful commands without seeing the risks. Once the initial command is run, Amatera Stealer is delivered first, followed by the installation of NetSupport Manager, which allows hackers to monitor and control the compromised machine as though they were physically present.

Amatera Stealer is not an entirely new threat but the latest evolution of ACR Stealer, also known as AcridRain. The earlier version first appeared as a malware-as-a-service product on hacker forums in 2024, which several users deployed through subscription packages.

Sales of ACR were paused in mid-2024 when its developer, known online as SheldIO, sold the malware’s source code. Despite the sale announcement, the group said it was “not the end” of its development. Researchers now believe Amatera is the direct successor to ACR, rebuilt with more capabilities and new evasion techniques.

Amatera, spotted by security auditing firm Proofpoint in June, is available on a subscription basis from $199 per month to $1,499 annually.

“Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services. It employs advanced evasion strategies like WoW64 SysCalls to circumvent user-mode hooking mechanisms used by sandboxes, Anti-Virus solutions, and EDR products,” eSentire said.

The malware is written in C++ and is capable of harvesting saved passwords, card details, browsing histories, and files from browsers like Chrome, Brave, Edge, Opera, Firefox, and specialized platforms such as Tor Browser and Thunderbird. 

Multi-stage Windows PowerShell loaders hiding malware

According to eSentire’s threat analysis, the Amatera’s infection process is built on several layers of obfuscated PowerShell commands. 

TRU researchers saw one phase decrypting subsequent payloads using an XOR process on the string “AMSI_RESULT_NOT_DETECTED,” a term associated with Microsoft’s Anti-Malware Scan Interface. The loader’s developer could have selected the phrase intentionally to confuse researchers conducting dynamic analysis.

While Amatera is the most common payload delivered in these campaigns, eSentire also documented cases where the same loader was used to deploy other infostealers, including Lumma and Vidar. Some samples lacked configuration parameters needed to run multi-stage loaders, in which hackers chose to deploy NetSupport Manager directly instead.

eSentire and other security firms have documented email campaigns distributing Visual Basic Script files disguised as invoices. When opened, the files executed batch scripts that initiated PowerShell loaders delivering XWorm.

Other campaigns involved compromised websites that redirected visitors to fake Cloudflare verification pages, which mimic ClickFix prompts. This activity has been tied to an operation known by names including SmartApeSG, HANEYMANEY, and ZPHP, all coming with NetSupport RAT as their final payload.

Hackers had built fraudulent Booking.com websites that hosted counterfeit CAPTCHA checks, instructing users to open the Windows Run dialog and execute a command, and directly installing a credential-stealing script onto infected systems.

Some of the phishing campaigns connected to these malware deliveries are using a new phishing kit known as Cephas. Cephas, according to cybersecurity solutions firm Barracuda, uses an advanced obfuscation method that inserts invisible characters into the source code of phishing pages, difficult for automated scanners to detect.

“The kit obscures its code by creating random invisible characters within the source code that help it evade anti-phishing scanners and obstruct signature-based YARA rules from matching the exact phishing methods,” Barracuda wrote in its analysis last week.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.

Market Opportunity
Zypher Network Logo
Zypher Network Price(POP)
$0.0006599
$0.0006599$0.0006599
-1.09%
USD
Zypher Network (POP) Live Price Chart
Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact [email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

Is Putnam Global Technology A (PGTAX) a strong mutual fund pick right now?

Is Putnam Global Technology A (PGTAX) a strong mutual fund pick right now?

The post Is Putnam Global Technology A (PGTAX) a strong mutual fund pick right now? appeared on BitcoinEthereumNews.com. On the lookout for a Sector – Tech fund? Starting with Putnam Global Technology A (PGTAX – Free Report) should not be a possibility at this time. PGTAX possesses a Zacks Mutual Fund Rank of 4 (Sell), which is based on various forecasting factors like size, cost, and past performance. Objective We note that PGTAX is a Sector – Tech option, and this area is loaded with many options. Found in a wide number of industries such as semiconductors, software, internet, and networking, tech companies are everywhere. Thus, Sector – Tech mutual funds that invest in technology let investors own a stake in a notoriously volatile sector, but with a much more diversified approach. History of fund/manager Putnam Funds is based in Canton, MA, and is the manager of PGTAX. The Putnam Global Technology A made its debut in January of 2009 and PGTAX has managed to accumulate roughly $650.01 million in assets, as of the most recently available information. The fund is currently managed by Di Yao who has been in charge of the fund since December of 2012. Performance Obviously, what investors are looking for in these funds is strong performance relative to their peers. PGTAX has a 5-year annualized total return of 14.46%, and is in the middle third among its category peers. But if you are looking for a shorter time frame, it is also worth looking at its 3-year annualized total return of 27.02%, which places it in the middle third during this time-frame. It is important to note that the product’s returns may not reflect all its expenses. Any fees not reflected would lower the returns. Total returns do not reflect the fund’s [%] sale charge. If sales charges were included, total returns would have been lower. When looking at a fund’s performance, it…
Share
BitcoinEthereumNews2025/09/18 04:05
Crypto Casino Luck.io Pays Influencers Up to $500K Monthly – But Why?

Crypto Casino Luck.io Pays Influencers Up to $500K Monthly – But Why?

Crypto casino Luck.io is reportedly paying influencers six figures a month to promote its services, a June 18 X post from popular crypto trader Jordan Fish, aka Cobie, shows. Crypto Influencers Reportedly Earning Six Figures Monthly According to a screenshot of messages between Cobie and an unidentified source embedded in the Wednesday post, the anonymous messenger confirmed that the crypto company pays influencers “around” $500,000 per month to promote the casino. They’re paying extremely well (6 fig per month) pic.twitter.com/AKRVKU9vp4 — Cobie (@cobie) June 18, 2025 However, not everyone was as convinced of the number’s accuracy. “That’s only for Faze Banks probably,” one user replied. “Other influencers are getting $20-40k per month. So, same as other online crypto casinos.” Cobie pushed back on the user’s claims by identifying the messenger as “a crypto person,” going on to state that he knew of “4 other crypto people” earning “above 200k” from Luck.io. Drake’s Massive Stake.com Deal Cobie’s post comes amid growing speculation over celebrity and influencer collaborations with crypto casinos globally. Aubrey Graham, better known as Toronto-based rapper Drake, is reported to make nearly $100 million every year from his partnership with cryptocurrency casino Stake.com. As part of his deal with the Curaçao-based digital casino, the “Nokia” rapper occasionally hosts live-stream gambling sessions for his more than 140 million Instagram followers. Founded by entrepreneurs Ed Craven and Bijan Therani in 2017, the organization allegedly raked in $2.6 billion in 2022. Stake.com has even solidified key partnerships with Alfa Romeo’s F1 team and Liverpool-based Everton Football Club. However, concerns remain over crypto casinos’ legality as a whole , given their massive accessibility and reach online. Earlier this year, Stake was slapped with litigation out of Illinois for supposedly running an illegal online casino stateside while causing “severe harm to vulnerable populations.” “Stake floods social media platforms with slick ads, influencer videos, and flashy visuals, making its games seem safe, fun, and harmless,” the lawsuit claims. “By masking its real-money gambling platform as just another “social casino,” Stake creates exactly the kind of dangerous environment that Illinois gambling laws were designed to stop.”
Share
CryptoNews2025/06/19 04:53
U.S. Banks Near Stablecoin Issuance Under FDIC Genius Act Plan

U.S. Banks Near Stablecoin Issuance Under FDIC Genius Act Plan

The post U.S. Banks Near Stablecoin Issuance Under FDIC Genius Act Plan appeared on BitcoinEthereumNews.com. U.S. banks could soon begin applying to issue payment
Share
BitcoinEthereumNews2025/12/17 02:55