Executive Summary
Amatera is a sophisticated infostealer malware that emerged as the top infostealer detection in Latin America during the first half of 2026, according to ESET telemetry. The malware is distributed through malvertising campaigns, trojanized software installers, and phishing lures, targeting stored credentials, browser session tokens, cryptocurrency wallets, and sensitive files. Once executed, Amatera exfiltrates harvested data over encrypted channels to attacker-controlled command-and-control infrastructure, demonstrating a highly professionalized cybercrime supply chain model. Its modular architecture and stealth evasion techniques make it difficult to detect with signature-based tools alone, amplifying the risk to enterprise environments across financial services, retail, and healthcare sectors.
Amatera exemplifies the growing commoditization of infostealer-as-a-service operations, where low-barrier access to advanced credential-theft tooling enables a broad range of threat actors to conduct high-impact campaigns. The rise of such professionalized malware families mirrors broader trends including the increased targeting of cloud-hosted identities, MFA bypass via stolen session tokens, and downstream ransomware deployment using harvested credentials.
Why This Matters Now
Infostealers like Amatera are fueling a surge in identity-based breaches, with stolen session tokens and credentials bypassing MFA controls and enabling rapid lateral movement into cloud environments. As enterprises accelerate cloud adoption across Latin America and beyond, unmonitored egress paths and flat network architectures provide exactly the exfiltration opportunities these tools exploit, making network-layer controls and zero trust segmentation urgently necessary.
Attack Path Analysis
Amatera infostealer spreads through phishing lures, malicious advertisements, and trojanized software bundles targeting Latin American users, establishing persistence and harvesting credentials, browser data, and session tokens from compromised endpoints. Once active, the malware communicates with attacker-controlled C2 infrastructure to exfiltrate stolen data, with the professionalized cybercrime operation monetizing credentials and sensitive information through underground markets.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Amatera is distributed via phishing emails, malvertising campaigns, and trojanized software installers targeting end users in Latin America. Victims are socially engineered into executing the malware dropper, which installs the infostealer payload on the host system.
MITRE ATT&CK® Techniques
Phishing
User Execution: Malicious File
Credentials from Password Stores
Steal Web Session Cookie
Exfiltration Over C2 Channel
Screen Capture
Obfuscated Files or Information
Browser Extensions
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Identification and Authentication Management
Control ID: Requirement 8.2 / 8.6
NYDFS 23 NYCRR 500 – Monitoring and Access Privileges
Control ID: Section 500.14 / 500.07
DORA (EU 2022/2554) – ICT Security Controls and Incident Response
Control ID: Article 9 — ICT Security Policies / Article 17 — ICT-Related Incident Management
CISA Zero Trust Maturity Model 2.0 – Identity Integrity and Device Trustworthiness
Control ID: Identity Pillar — Credential Management / Device Pillar — Endpoint Visibility
NIS2 Directive (EU 2022/2555) – Supply Chain and Malware Risk Controls
Control ID: Article 21 — Cybersecurity Risk Management Measures
GDPR (EU 2016/679) – Data Protection and Breach Reporting
Control ID: Article 32 — Security of Processing / Article 33 — Breach Notification
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Amatera infostealer poses critical risk to financial services via credential exfiltration, with validated egress and lateral movement vectors enabling unauthorized access to banking and payment systems under PCI 4.0 mandates.
Information Technology/IT
IT environments face elevated exposure as Amatera targets system credentials and data in transit; validated IPS and zero trust segmentation gaps amplify privilege escalation and east-west lateral movement risks across hybrid cloud infrastructure.
Health Care / Life Sciences
Prolific infostealer activity threatens protected health information under HIPAA 164.312 mandates, with unencrypted traffic and insufficient egress policy enforcement creating viable exfiltration pathways from clinical and administrative systems.
Retail Industry
Latin American retail operations face significant Amatera infostealer exposure targeting payment credentials and customer PII, with PCI 4.0 compliance gaps in egress filtering and multicloud visibility increasing data breach probability.
Sources
- Amatera: How the prolific infostealer works and spreadshttps://www.welivesecurity.com/en/malware/amatera-how-prolific-infostealer-works-spreads/Verified
- ESET Threat Report H1 2025https://www.welivesecurity.com/en/eset-research/eset-threat-report-h12025/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- MITRE ATT&CK - Steal Web Session Cookie (T1539)https://attack.mitre.org/techniques/T1539/Verified
- Infostealer Malware Overview - CISAhttps://www.cisa.gov/news-events/cybersecurity-advisoriesVerified
- Latin America Cybercrime Trends and Infostealer Activityhttps://www.welivesecurity.com/en/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant to Amatera because the infostealer relies on unrestricted outbound egress and lateral credential reuse to reach cloud and SaaS environments after initial endpoint compromise. By enforcing identity-aware segmentation and controlled egress paths, CNSF would likely reduce the attacker's ability to pivot from a compromised endpoint into cloud-hosted workloads and exfiltrate harvested data at scale.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-wide visibility could reduce attacker reach by flagging unexpected inbound delivery patterns and limiting unvetted workload communication paths that an initial dropper payload would typically rely on to establish a foothold.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what a compromised user identity can reach, reducing the attacker's ability to leverage harvested tokens or credentials to access additional protected workloads or data stores across segmented boundaries.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the reachability of attacker-controlled sessions attempting to move laterally between cloud workloads by requiring that traffic between segments conform to defined identity and policy baselines rather than accepting session tokens at face value.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility could reduce the effectiveness of C2 communication by surfacing anomalous outbound connection patterns from workloads or endpoints that would not ordinarily initiate encrypted sessions to unrecognized external destinations.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely reduce the attacker's ability to transmit harvested credential packages and session tokens outbound by constraining which destinations and protocols are permitted from workloads or endpoints operating within the protected environment.
Where prior CNSF controls reduce the volume of harvested credentials that successfully reach attacker infrastructure, the downstream impact scope would likely be narrowed, limiting the number of cloud accounts, SaaS sessions, and corporate environments exposed to account takeover or secondary intrusion.
Impact at a Glance
Affected Business Functions
- End-User Credential and Identity Management
- Online Banking and Financial Account Access
- E-commerce Account Security and Consumer PII Protection
- Corporate VPN and Remote Access Authentication
Estimated downtime: N/A
Estimated loss: N/A
Amatera is a prolific infostealer targeting users primarily in Latin America. The malware is designed to harvest a broad spectrum of sensitive data from infected endpoints, including browser-stored credentials (usernames and passwords), session cookies enabling account takeover without re-authentication, autofill data containing PII such as names, addresses, and phone numbers, cryptocurrency wallet credentials and private keys, credit card and financial account details stored in browsers, and messaging application tokens. Victims span individual consumers and corporate employees, meaning both personal financial accounts and enterprise credentials are at risk. The professionalized cybercrime ecosystem around Amatera suggests stolen data is sold via underground markets or used in downstream fraud, business email compromise, and unauthorized financial transfers.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls to detect and block Amatera's C2 beacon and data exfiltration channels before stolen credentials leave the network perimeter.
- • Enable Inline IPS (Suricata) with up-to-date threat signatures to identify known Amatera payload delivery patterns, malvertising redirects, and malicious dropper downloads at the network layer before execution occurs.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policies to limit the blast radius of a compromised endpoint, preventing harvested credentials from being used to pivot into cloud workloads, SaaS services, or internal systems.
- • Activate Multicloud Visibility & Control to establish behavioral baselines and detect anomalous outbound connection patterns, repeated data transfers to unknown destinations, and suspicious automation indicative of infostealer activity across hybrid and cloud environments.
- • Apply Encrypted Traffic inspection capabilities where feasible to reduce the advantage Amatera gains by tunneling exfiltrated data over HTTPS, ensuring outbound encrypted flows to unrecognized or uncategorized destinations are subject to policy enforcement and alerting.
