Proofpoint researchers have uncovered advanced campaigns distributing Amatera Stealer – a rebranded evolution of ACR Stealer through compromised websites.
The malware leverages ClearFake web injects, where legitimate sites are hijacked to load malicious scripts via EtherHiding (hosting payloads on Binance Smart Chain contracts). This initiates a multi-stage attack:
Victims encounter...