Scworld

Amatera Infostealer Campaign Uses Fake CAPTCHA and App-V Scripts

First seen 28 Jan 2026, 02:54 UTC • Bleepingcomputer

•53.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A new campaign is distributing the Amatera infostealing malware by employing a fake CAPTCHA method alongside a signed Microsoft Application Virtualization (App-V) script. This attack utilizes legitimate Microsoft components to mask its malicious activities, tricking users into executing harmful commands on their systems.

How this analysis works

Attack Flow

15 entities, 13 inferred relationships (STIX 2.1).

Technique (6)

Malware
Steganography
T1047 - Windows Management Instrumentation
T1059.001 - PowerShell
T1059.005 - VBScript
T1218 - Signed Binary Proxy Execution

Campaign (1)

Amatera Infostealer Campaign

Malware (4)

ClickFix
ACR Infostealer
Amatera
Amatera Infostealer

Affected Platform (1)

Windows

Tool (3)

PowerShell
SyncAppvPublishingServer.vbs
Wscript.exe

Relationships

Amatera Infostealer Campaign uses ClickFix
Amatera Infostealer Campaign uses ACR Infostealer
Amatera Infostealer Campaign uses Amatera
Amatera Infostealer Campaign uses Amatera Infostealer
Malware targets Windows
Steganography targets Windows
T1047 - Windows Management Instrumentation targets Windows
T1059.001 - PowerShell targets Windows
T1059.005 - VBScript targets Windows
T1218 - Signed Binary Proxy Execution targets Windows
Amatera Infostealer Campaign related to PowerShell
Amatera Infostealer Campaign related to SyncAppvPublishingServer.vbs
Amatera Infostealer Campaign related to Wscript.exe

Continue Reading

Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants Rapid7 Reports Surge in Vulnerability Exploitation Outpacing Patching Efforts ACSC Issues Critical Alert on Exploited CMS Vulnerabilities Cybercriminals Exploit BNB Chain for Malware via Fake CAPTCHAs

Amatera Infostealer Campaign Uses Fake CAPTCHA and App-V Scripts

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading