Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix. eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to […]Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix. eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to […]

Hackers target crypto wallets, browser data in fake reCAPTCHA pop-up campaign

2025/11/18 19:33

Cybersecurity group eSentire has uncovered the use of fake CAPTCHA-style pop-ups to trick victims into deploying credential-harvesting malware, Amatera Stealer, and NETSupport RAT by abusing a method known as ClickFix.

eSentire’s Threat Response Unit (TRU) has been tracking an escalation in campaigns abusing ClickFix to gain initial access to targeted systems in November. According to the TRU, threat actors use the method to socially engineer victims into running malicious commands manually through the Windows Run prompt. 

Once executed, those commands launch an infection chain that ends with the deployment of Amatera Stealer and NetSupport RAT, both legitimate remote monitoring tools that have been repurposed by cybercriminals for unauthorized remote access.

ClickFix campaign uses reCAPTCHA to sneak malware in

Per eSentire’s research published last Thursday, hackers are luring victims using fake websites and pop-ups that look like “security checks,” including fraudulent reCAPTCHA verification boxes and counterfeit Cloudflare Turnstile pages. 

The deceptive interfaces prompt users to “fix” a supposed issue, with the instructions causing them to execute harmful commands without seeing the risks. Once the initial command is run, Amatera Stealer is delivered first, followed by the installation of NetSupport Manager, which allows hackers to monitor and control the compromised machine as though they were physically present.

Amatera Stealer is not an entirely new threat but the latest evolution of ACR Stealer, also known as AcridRain. The earlier version first appeared as a malware-as-a-service product on hacker forums in 2024, which several users deployed through subscription packages.

Sales of ACR were paused in mid-2024 when its developer, known online as SheldIO, sold the malware’s source code. Despite the sale announcement, the group said it was “not the end” of its development. Researchers now believe Amatera is the direct successor to ACR, rebuilt with more capabilities and new evasion techniques.

Amatera, spotted by security auditing firm Proofpoint in June, is available on a subscription basis from $199 per month to $1,499 annually.

“Amatera provides threat actors with extensive data exfiltration capabilities targeting crypto-wallets, browsers, messaging applications, FTP clients, and email services. It employs advanced evasion strategies like WoW64 SysCalls to circumvent user-mode hooking mechanisms used by sandboxes, Anti-Virus solutions, and EDR products,” eSentire said.

The malware is written in C++ and is capable of harvesting saved passwords, card details, browsing histories, and files from browsers like Chrome, Brave, Edge, Opera, Firefox, and specialized platforms such as Tor Browser and Thunderbird. 

Multi-stage Windows PowerShell loaders hiding malware

According to eSentire’s threat analysis, the Amatera’s infection process is built on several layers of obfuscated PowerShell commands. 

TRU researchers saw one phase decrypting subsequent payloads using an XOR process on the string “AMSI_RESULT_NOT_DETECTED,” a term associated with Microsoft’s Anti-Malware Scan Interface. The loader’s developer could have selected the phrase intentionally to confuse researchers conducting dynamic analysis.

While Amatera is the most common payload delivered in these campaigns, eSentire also documented cases where the same loader was used to deploy other infostealers, including Lumma and Vidar. Some samples lacked configuration parameters needed to run multi-stage loaders, in which hackers chose to deploy NetSupport Manager directly instead.

eSentire and other security firms have documented email campaigns distributing Visual Basic Script files disguised as invoices. When opened, the files executed batch scripts that initiated PowerShell loaders delivering XWorm.

Other campaigns involved compromised websites that redirected visitors to fake Cloudflare verification pages, which mimic ClickFix prompts. This activity has been tied to an operation known by names including SmartApeSG, HANEYMANEY, and ZPHP, all coming with NetSupport RAT as their final payload.

Hackers had built fraudulent Booking.com websites that hosted counterfeit CAPTCHA checks, instructing users to open the Windows Run dialog and execute a command, and directly installing a credential-stealing script onto infected systems.

Some of the phishing campaigns connected to these malware deliveries are using a new phishing kit known as Cephas. Cephas, according to cybersecurity solutions firm Barracuda, uses an advanced obfuscation method that inserts invisible characters into the source code of phishing pages, difficult for automated scanners to detect.

“The kit obscures its code by creating random invisible characters within the source code that help it evade anti-phishing scanners and obstruct signature-based YARA rules from matching the exact phishing methods,” Barracuda wrote in its analysis last week.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.

Disclaimer: The articles reposted on this site are sourced from public platforms and are provided for informational purposes only. They do not necessarily reflect the views of MEXC. All rights remain with the original authors. If you believe any content infringes on third-party rights, please contact [email protected] for removal. MEXC makes no guarantees regarding the accuracy, completeness, or timeliness of the content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be considered a recommendation or endorsement by MEXC.

You May Also Like

XAG/USD refreshes record high, around $61.00

XAG/USD refreshes record high, around $61.00

The post XAG/USD refreshes record high, around $61.00 appeared on BitcoinEthereumNews.com. Silver (XAG/USD) enters a bullish consolidation phase during the Asian session and oscillates in a narrow range near the all-time peak, around the $61.00 neighborhood, touched this Wednesday. Meanwhile, the broader technical setup suggests that the path of least resistance for the white metal remains to the upside. The overnight breakout through the monthly trading range hurdle, around the $58.80-$58.85 region, was seen as a fresh trigger for the XAG/USD bulls. However, the Relative Strength Index (RSI) is flashing overbought conditions on 4-hour/daily charts, which, in turn, is holding back traders from placing fresh bullish bets. Hence, it will be prudent to wait for some near-term consolidation or a modest pullback before positioning for a further appreciating move. Meanwhile, any corrective slide below the $60.30-$60.20 immediate support could attract fresh buyers and find decent support near the $60.00 psychological mark. A convincing break below the said handle, however, might prompt some long-unwinding and drag the XAG/USD towards the trading range resistance breakpoint, around the $58.80-$58.85 region. The latter should act as a key pivotal point, which, if broken, could pave the way for further losses. On the flip side, momentum above the $61.00 mark will reaffirm the near-term constructive outlook and set the stage for an extension of the XAG/USD’s recent strong move up from the vicinity of mid-$45.00s, or late October swing low. Silver 4-hour chart Silver FAQs Silver is a precious metal highly traded among investors. It has been historically used as a store of value and a medium of exchange. Although less popular than Gold, traders may turn to Silver to diversify their investment portfolio, for its intrinsic value or as a potential hedge during high-inflation periods. Investors can buy physical Silver, in coins or in bars, or trade it through vehicles such as Exchange Traded Funds,…
Share
BitcoinEthereumNews2025/12/10 10:20
Tokenized Assets Shift From Wrappers to Building Blocks in DeFi

Tokenized Assets Shift From Wrappers to Building Blocks in DeFi

The post Tokenized Assets Shift From Wrappers to Building Blocks in DeFi appeared on BitcoinEthereumNews.com. RWAs are rapidly moving on-chain, unlocking new opportunities for investors and DeFi protocols, according to a new report from Dune and RWAxyz. Tokenized real-world assets (RWAs) are moving beyond digital versions of traditional securities to become key building blocks of decentralized finance (DeFi), according to the 2025 RWA Report from Dune and RWAxyz. The report notes that Treasuries, bonds, credit, and equities are now being used in DeFi as collateral, trading instruments, and yield products. This marks tokenization’s “real breakthrough” – composability, or the ability to combine and reuse assets across different protocols. Projects are already showing how this works in practice. Asset manager Maple Finance’s syrupUSDC, for example, has grown to $2.5 billion, with more than 30% placed in DeFi apps like Spark ($570 million). Centrifuge’s new deJAAA token, a wrapper for Janus Henderson’s AAA CLO fund, is already trading on Aerodrome, Coinbase and other exchanges, with Stellar planned next. Meanwhile, Aave’s Horizon RWA Market now lets institutional users post tokenized Treasuries and CLOs as collateral. This trend underscores a bigger shift: RWAs are no longer just copies of traditional assets; instead, they are becoming core parts of on-chain finance, powering lending, liquidity, and yield, and helping to close the gap between traditional finance (TradFi) and DeFi. “RWAs have crossed the chasm from experimentation to execution,” Sid Powell, CEO of Maple Finance, says in the report. “Our growth to $3.5B AUM reflects a broader shift: traditional financial services are adopting crypto assets while institutions seek exposure to on-chain markets.” Investor demand for higher returns and more diversified options is mainly driving this growth. Tokenized Treasuries proved there is strong demand, with $7.3 billion issued by September 2025 – up 85% year-to-date. The growth was led by BlackRock, WisdomTree, Ondo, and Centrifuge’s JTRSY (Janus Henderson Anemoy Treasury Fund). Spark’s $1…
Share
BitcoinEthereumNews2025/09/18 06:10