# Amatera in LATAM: fake verification prompts put business access at risk Canonical: https://www.oktsec.com/radar/amatera-stealer-latam-clickfix Publisher: Oktsec Language: en Published: 2026-11-04T20:47:43Z Updated: 2026-11-04T20:47:43Z Record reviewed: 2026-11-04T20:47:43Z Latest evidence check: 2026-11-04T20:47:43Z Disclosed: 2026-11-03 COLCERT warns about Amatera, also tracked as ACR Stealer, in Latin America. Documented campaigns use fake verification prompts and impersonated software pages to steal credentials, session cookies and development secrets from Windows systems. ## Evidence and response priority - Category: Threat activity - Oktsec priority: Review this week - Rationale: Regional reporting and documented intrusion chains support prevention and detection review this week. Local signs of infection require immediate containment and account recovery. - Evidence: Research report - Verification: Multiple sources - Fix status: Not applicable - Exposure requirement: Application or configuration dependent - Target sector: Windows users and development teams in Latin America - Products: Microsoft Windows ## Research findings COLCERT’s November 3 alert brings attention to Amatera, also tracked as ACR Stealer, in Latin America. It describes malware for Windows distributed through social engineering, malicious advertising and websites that impersonate legitimate software. Multiple operators can distribute this malware; the sources do not establish one regional attacker or one uniform campaign. A common entry point is ClickFix: a fake CAPTCHA, browser error or installation prompt persuades a person to execute a command. Researchers also documented pages impersonating AI and development tools. This is abuse of those brands, not evidence that the legitimate products are compromised. A page visit alone does not establish infection. ESET reports that Amatera led its infostealer detections in Latin America during the first half of 2026. That ranking describes ESET telemetry, not all regional infections or a count of unique victims. COLCERT cites this earlier research; the alert date does not prove a new surge began in November. Microsoft separately documented intrusion chains observed between late April and mid-June, while Straiker’s impersonation research was published in May. Stolen passwords, cookies, tokens and development secrets can enable access beyond the original endpoint. Session theft may bypass a new login challenge where the stolen session remains accepted; it does not mean every MFA implementation is defeated. Oktsec recommends reviewing prevention and detection this week and responding immediately to credible local evidence. Containment, device recovery and account recovery are separate tasks. Revoke affected sessions and rotate exposed secrets from a trusted device; cleaning or reinstalling the endpoint does not invalidate data already stolen. ## Recommended response Treat requests to paste commands for a CAPTCHA as suspicious. If infection is suspected, isolate the device, preserve evidence and revoke affected sessions and rotate exposed secrets from a trusted device. Relevant to: Teams managing Windows endpoints and business identities in Latin America, including developers using software and AI tools. ## Response checklist 1. **Stop fake verification prompts from becoming commands** — Train staff to reject CAPTCHA instructions that ask them to paste commands into Windows Run or a shell. Use official software sources and verify domains; a sponsored search result is not proof of authenticity. 2. **Review execution and credential access** — Use application controls appropriate to each role. Investigate unexpected browser-to-shell activity, PowerShell or MSHTA launches, scheduled tasks and access to browser credential stores. Use dated indicators with behavioral evidence; a single match is not proof of infection. 3. **Isolate and preserve evidence** — If compromise is suspected, isolate the endpoint and preserve relevant endpoint, browser and identity logs. Coordinate recovery or reinstallation with the response team. Do not use the potentially compromised device to reset credentials. 4. **Revoke sessions and replace exposed secrets** — From a trusted device, revoke affected sessions and tokens. Reset exposed passwords and rotate API keys, SSH keys and other credentials present on the endpoint. A password reset or a clean reinstall may leave previously stolen sessions usable. 5. **Check access beyond the original device** — Review activity in email, cloud services, repositories and other applications accessible through the affected accounts. Scope recovery to evidence and exposure; malware removal alone does not establish that business accounts are secure. ## Relevance to AI environments Campaigns impersonate AI and development tools and may steal their credentials. This does not establish a vulnerability in the legitimate tools or an attack performed by an AI agent. ## Sources - [COLCERT AL 20261103 125: regional warning and response guidance](https://www.colcert.gov.co/800/articles-442397_COLCERT_AL__20261103__125_Alerta_Aumento_de_campanas_del_infostealer_Amatera_ACR_Stealer_en_America_Latina.pdf) — COLCERT; Government advisory; checked 2026-11-04T20:41:46Z - [Amatera detections in Latin America during the first half of 2026](https://www.welivesecurity.com/es/malware/amatera-infostealer-en-aumento-america-latina/) — ESET; Research report; checked 2026-11-04T20:41:46Z - [ACR Stealer: two intrusion chains observed from April to June](https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/) — Microsoft Security Research; Research report; checked 2026-11-04T20:41:46Z - [May research into impersonated AI and development tool pages](https://www.straiker.ai/blog/acr-stealer-claude-code-impersonation-campaign) — Straiker; Research report; checked 2026-11-04T20:41:46Z ## Editorial record - 2026-11-04T20:47:43Z: Added verified scope, source evidence and response guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/amatera-stealer-latam-clickfix) · [Build a response plan](https://www.oktsec.com/radar/amatera-stealer-latam-clickfix#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=amatera-stealer-latam-clickfix&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=amatera-stealer-latam-clickfix&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.