Fast Facts

• The EVALUSION campaign uses fake security prompts to trick users into running malicious commands.
• Amatera Stealer targets crypto wallets, browsers, and messaging apps, using advanced evasion techniques to dodge antivirus tools.
• NetSupport RAT, a remote access tool, is delivered only if valuable data or domain access is detected on the victim’s machine.
• The attack chain relies on "ClickFix," a social engineering method that leverages the Windows Run dialog and PowerShell scripts.
• Similar phishing campaigns are spreading a variety of malware, including XWorm and credential stealers, via emails and fake websites.

A New Breed of Digital Deceit

Imagine a digital con artist who doesn’t break into your house but instead slips you a fake key and asks you to unlock the door yourself. That’s the essence of the latest EVALUSION campaign, a sophisticated wave of attacks tracked by cybersecurity firm eSentire. Using the now-notorious "ClickFix" technique, hackers are tricking everyday users into running harmful commands-thinking they’re just passing a CAPTCHA test-only to invite malware in through the front door.

The Anatomy of the Attack

The attack begins with a phishing page masquerading as a legitimate site, complete with a fake reCAPTCHA challenge. Victims are instructed to copy and paste a command into their Windows Run dialog-a move that activates a multi-stage infection process. The real payload: Amatera Stealer, a malware-for-hire tool that specializes in vacuuming up personal data, from crypto wallets to browser credentials and messaging accounts. Amatera is the latest evolution of the ACR (AcridRain) Stealer, now sold on the dark web for up to $1,499 a year.

What makes Amatera dangerous isn’t just its appetite for sensitive data-it’s also built to slip past defensive software. By using techniques like WoW64 SysCalls, it sidesteps traditional antivirus and endpoint detection, hiding its tracks like a burglar with a skeleton key. Once inside, it checks if the computer is part of a business network or holds valuable files. If so, it downloads NetSupport RAT, a legitimate remote access tool repurposed by criminals to control systems remotely and steal even more.

A Broader Menace: The Rise of ClickFix and MaaS

The EVALUSION campaign is just one example in a growing trend. Recent months have seen a surge in phishing attacks leveraging ClickFix, from fake Booking.com sites to spoofed invoice emails. Attackers use everything from Visual Basic scripts to malicious JavaScript, redirecting victims to booby-trapped web pages or convincing them to run dangerous commands. The rise of Malware-as-a-Service (MaaS) has lowered the bar, allowing less-skilled criminals to rent powerful tools like Amatera and PureCrypter, making these campaigns harder to trace and stop.

Even phishing kits are getting upgrades. New kits like Cephas use invisible characters to evade detection by anti-phishing scanners, while others like Tycoon 2FA mimic two-factor authentication screens to steal credentials. The result is a cat-and-mouse game, with security teams racing to adapt as attackers refine their tricks.

WIKICROOK

• ClickFix: ClickFix is a scam where users are deceived into copying and pasting harmful code, often after a fake CAPTCHA, risking their accounts and data.
• Amatera Stealer: Amatera Stealer is malware that steals passwords, crypto wallets, and messages, often sold as a subscription to cybercriminals.
• NetSupport RAT: NetSupport RAT is a remote access tool often abused by hackers to secretly control computers and steal sensitive information.
• Malware: Il malware è un software dannoso progettato per infiltrarsi, danneggiare o rubare dati da dispositivi informatici senza il consenso dell’utente.
• Phishing Kit: A phishing kit is a set of ready-made tools that allows criminals to quickly create fake websites and steal sensitive user information.