Amatera: How the prolific infostealer works and spreads

Infostealers have become an established business, with developers who produce and maintain the product and paying customers who run their own campaigns with them. Amatera – which topped ESET’s infostealer detections in Latin America in the first half of 2026 but targets victims worldwide – shows what this professionalization looks like in practice.

Like many other infostealers, Amatera goes after a range of data spanning login credentials, session cookies, tokens, crypto wallet information, messaging data, files, and secrets from development environments. The sheer breadth of the loot shows why infostealers are a mainstay of cybercrime – a single compromise can lead to account hijacking, financial fraud and crypto theft, as well as open the door into the organization where the victim works.

Here’s more about where Amatera came from, along with its business model, capabilities, and distribution.

What is Amatera?

Detected by ESET products as Win/PSW.Amatera, Amatera is a...

Copyright of this story solely belongs to www.welivesecurity.com. To see the full text click HERE