Amatera Infostealer: Why Server-Side Defences Still Matter

A new name, an old playbookAmatera, also tracked as ACR Stealer, is a Windows infostealer written in C++ that first appeared in 2024. It is sold as Ma...

A new name, an old playbook

Amatera, also tracked as ACR Stealer, is a Windows infostealer written in C++ that first appeared in 2024. It is sold as Malware-as-a-Service: the developers maintain the code, the control panel and the support channels, while affiliates pay a subscription to run their own campaigns. Reports from several security vendors suggest it is a rebrand of an earlier stealer, itself an evolution of a previous family — a pattern that is entirely routine in the malware economy, where code is retired, refreshed and relaunched under a new name to frustrate tracking and reset its reputation.

What makes Amatera relevant well beyond its original hunting grounds is its reach. Although detection volumes have been particularly high across Latin America during 2026, the campaigns themselves are global. For system administrators and hosting providers in Catalonia and across Spain, the practical question is not where the malware was written, but what it does once it lands on a workstation that holds credentials to your servers.

What Amatera actually harvests

The payload is designed to extract anything of value from a compromised machine. Public analyses describe the following targets:

Saved browser credentials, autofill data and browsing history
Session cookies, which allow attackers to hijack accounts without ever needing a password
Session and authentication tokens used by cloud and enterprise services
Cryptocurrency wallet data, in some cases by manipulating the clipboard
Documents and files synchronised with cloud storage platforms
Messaging data and artefacts from development environments

The last two points deserve attention. A stolen developer token or an SSH key sitting in a project folder is not a consumer problem — it is a direct route into production infrastructure. A single infection on a laptop can therefore escalate into an intrusion against the organisation that laptop belongs to.

ClickFix: the victim does the work

Amatera is the final stage of several different delivery chains, which is exactly what you would expect from a service model where each affiliate chooses their own distribution method. Documented vectors include compromised legitimate websites, search engine ads, fake documents, targeted emails and SVG files.

The technique that recurs most often is ClickFix. A page imitates a CAPTCHA check, a browser error or an installation guide, then instructs the visitor to copy a command and run it on their own machine. No exploit is required: the victim executes the first stage voluntarily. This is why signature-based defences alone struggle — the initial action looks like normal user behaviour.

Why endpoint protection is only half the story

Infostealers are an endpoint problem with infrastructure consequences. Once credentials, cookies or tokens are exfiltrated, the attacker no longer needs the original machine. They authenticate from their own infrastructure, using valid accounts, against your servers. From the perspective of a firewall or an application log, that traffic looks legitimate.

This is where perimeter and server-level controls earn their place. If a stolen credential is used from an unfamiliar address, the connection should not be allowed to proceed unchallenged. Rate limiting, geo-consistency checks and reputation-based blocking all reduce the window in which a stolen key is useful. Under GDPR, Article 32 requires technical measures proportionate to the risk, and credential-stuffing resilience is a reasonable part of that obligation for any organisation holding personal data on its own servers.

Layered defence for servers you actually own

For SMEs, hosting companies and administrators running their own machines in Barcelona, Lleida, Tarragona or Girona, a practical baseline looks like this:

Assume credentials will leak. Design access so that a stolen password or token is not sufficient on its own — enforce multi-factor authentication, short-lived tokens and least privilege.
Block at the network edge. Automated brute-force attempts against SSH, mail or control panels should be dropped before they reach the service, not logged and ignored.
Share threat intelligence across your fleet. An address that is hammering one server today will target the others tomorrow. Reputation data is far more useful when it is pooled than when each machine learns the same lesson independently.
Manage the tooling centrally. A brute-force mitigation tool deployed on twenty servers by hand is a maintenance liability; managed consistently across the fleet, it becomes an asset.

This is precisely the gap that Abuse Shield addresses. It centralises server protection: malicious IPs are blocked automatically, fail2ban is managed across multiple machines from one place, and a shared reputation feed means every server in your estate benefits from what the others have already seen. For a hosting provider running dozens of nodes, that shared feed turns isolated incidents into collective immunity.

The takeaway

Amatera is a reminder that modern intrusions rarely begin with a dramatic exploit. They begin with a convincing pop-up, a copied command and a stolen cookie. You cannot fully control what happens on every employee laptop. You can control how much a stolen credential is worth once it leaves that laptop — and that control lives on your servers.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.