Interfaz en español. Las fichas, los resúmenes y las fuentes conservan su idioma original.
Amatera in LATAM: fake verification prompts put business access at risk
Análisis de amenazas
COLCERT warns about Amatera, also tracked as ACR Stealer, in Latin America. Documented campaigns use fake verification prompts and impersonated software pages to steal credentials, session cookies and development secrets from Windows systems.
Quiénes deben revisar: Teams managing Windows endpoints and business identities in Latin America, including developers using software and AI tools.
Treat requests to paste commands for a CAPTCHA as suspicious. If infection is suspected, isolate the device, preserve evidence and revoke affected sessions and rotate exposed secrets from a trusted device.
¿Qué ocurrió y por qué es relevante?
COLCERT’s November 3 alert brings attention to Amatera, also tracked as ACR Stealer, in Latin America. It describes malware for Windows distributed through social engineering, malicious advertising and websites that impersonate legitimate software. Multiple operators can distribute this malware; the sources do not establish one regional attacker or one uniform campaign.
A common entry point is ClickFix: a fake CAPTCHA, browser error or installation prompt persuades a person to execute a command. Researchers also documented pages impersonating AI and development tools. This is abuse of those brands, not evidence that the legitimate products are compromised. A page visit alone does not establish infection.
ESET reports that Amatera led its infostealer detections in Latin America during the first half of 2026. That ranking describes ESET telemetry, not all regional infections or a count of unique victims. COLCERT cites this earlier research; the alert date does not prove a new surge began in November. Microsoft separately documented intrusion chains observed between late April and mid-June, while Straiker’s impersonation research was published in May.
Stolen passwords, cookies, tokens and development secrets can enable access beyond the original endpoint. Session theft may bypass a new login challenge where the stolen session remains accepted; it does not mean every MFA implementation is defeated.
Oktsec recommends reviewing prevention and detection this week and responding immediately to credible local evidence. Containment, device recovery and account recovery are separate tasks. Revoke affected sessions and rotate exposed secrets from a trusted device; cleaning or reinstalling the endpoint does not invalidate data already stolen.
- Sector afectado
- Windows users and development teams in Latin America
- Divulgado
- 3 nov 2026
- Última revisión de evidencia
- 4 nov 2026 UTC
¿Qué evidencia respalda este aviso?
Evidencia del incidente
Fundamento de la prioridad
Regional reporting and documented intrusion chains support prevention and detection review this week. Local signs of infection require immediate containment and account recovery.
¿Qué implica para los entornos de IA?
Campaigns impersonate AI and development tools and may steal their credentials. This does not establish a vulnerability in the legitimate tools or an attack performed by an AI agent.
Fuentes de este aviso
- COLCERT AL 20261103 125: regional warning and response guidanceCOLCERT · Revisado 4 nov 2026 UTC
- Amatera detections in Latin America during the first half of 2026ESET · Revisado 4 nov 2026 UTC
- ACR Stealer: two intrusion chains observed from April to JuneMicrosoft Security Research · Revisado 4 nov 2026 UTC
- May research into impersonated AI and development tool pagesStraiker · Revisado 4 nov 2026 UTC
Historial editorial1 entrada
Added verified scope, source evidence and response guidance.
Prepará tu respuesta
Usá esta lista para evaluar si el aviso afecta a tus sistemas, registrar las acciones de tu equipo y compartir el resultado. Radar no escanea ni verifica tu entorno.
Los cambios se guardan automáticamente en este navegador. No se sincronizan con tu equipo ni se envían a Oktsec.
1. Evaluá si aplica a tu entorno
Leé el aviso y sus fuentes; después registrá tu decisión. Si tenés dudas, elegí «Requiere verificación».
2. Registrá la respuesta
Indicá el sistema y la persona o equipo responsable. Actualizá cada acción y agregá una referencia al ticket o notas sobre lo revisado.
Stop fake verification prompts from becoming commands
Train staff to reject CAPTCHA instructions that ask them to paste commands into Windows Run or a shell. Use official software sources and verify domains; a sponsored search result is not proof of authenticity.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Review execution and credential access
Use application controls appropriate to each role. Investigate unexpected browser-to-shell activity, PowerShell or MSHTA launches, scheduled tasks and access to browser credential stores. Use dated indicators with behavioral evidence; a single match is not proof of infection.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Isolate and preserve evidence
If compromise is suspected, isolate the endpoint and preserve relevant endpoint, browser and identity logs. Coordinate recovery or reinstallation with the response team. Do not use the potentially compromised device to reset credentials.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Revoke sessions and replace exposed secrets
From a trusted device, revoke affected sessions and tokens. Reset exposed passwords and rotate API keys, SSH keys and other credentials present on the endpoint. A password reset or a clean reinstall may leave previously stolen sessions usable.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Check access beyond the original device
Review activity in email, cloud services, repositories and other applications accessible through the affected accounts. Scope recovery to evidence and exposure; malware removal alone does not establish that business accounts are secure.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.
3. Compartí el plan
Descargá un archivo Markdown con tu decisión, los estados de las acciones, las notas y las fuentes. Compartilo con tu equipo o adjuntalo a un ticket.
Sistemas afectados y correcciones
Compará la versión en ejecución y la configuración con las indicaciones del proveedor.
| Producto | Afectado | Versión corregida / acción |
|---|
Confirmá con el proveedor las correcciones adaptadas a tu distribución. Coincidir en el producto no basta para establecer exposición.
Evidencia y fuentes
Por qué tiene esta prioridad
Regional reporting and documented intrusion chains support prevention and detection review this week. Local signs of infection require immediate containment and account recovery.
Criterios de prioridadFuentes
Los datos técnicos provienen de estas fuentes. Las prioridades y las acciones recomendadas son el análisis de Oktsec.
- COLCERT AL 20261103 125: regional warning and response guidanceCOLCERT · Aviso gubernamental · Revisado 4 nov 2026 UTC
- Amatera detections in Latin America during the first half of 2026ESET · Informe de investigación · Revisado 4 nov 2026 UTC
- ACR Stealer: two intrusion chains observed from April to JuneMicrosoft Security Research · Informe de investigación · Revisado 4 nov 2026 UTC
- May research into impersonated AI and development tool pagesStraiker · Informe de investigación · Revisado 4 nov 2026 UTC
Registro técnicoProductos, identificadores y detalles de respaldo
| Servicios atacados | Microsoft WindowsWindows users and development teams in Latin America |
|---|---|
| Evidencia de investigación | Informe de investigación |
| Alcance de la investigación | Teams managing Windows endpoints and business identities in Latin America, including developers using software and AI tools. |
| Reportado por | COLCERT, ESET, Microsoft Security Research, Straiker |
- Divulgado
- 3 nov 2026
- Registro revisado
- 4 nov 2026 UTC
Para entornos con agentes de IA
Campaigns impersonate AI and development tools and may steal their credentials. This does not establish a vulnerability in the legitimate tools or an attack performed by an AI agent.