Executive Summary
In late April 2026, researchers intercepted a delivery of Amatera Stealer (formerly ACR/AcridRain) targeting the financial sector. This latest 4.0.2 Beta variant demonstrates a significant increase in technical sophistication, moving away from simple encryption in favor of complex security bypasses and hardened C2 communications.
The attack chain typically originates from 'ClickFix' lures, leading to PowerShell execution and a custom x86 shellcode loader. This loader uses reflective injection and aPLib decompression to execute the final payload in memory. Amatera 4.0.2 utilizes 'RecycledGate' for direct SysCalls to bypass EDR hooks and employs an ECDH (NIST P-256) key exchange with ChaCha20-Poly1305 for C2 traffic, making network-based decryption virtually impossible without memory artifacts.
This update is particularly concerning for individual and corporate financial security as the malware has tripled its desktop wallet targets (137 total) and nearly doubled its browser and extension harvesting list. Its focus on sensitive data like Signal attachments, Discord tokens, and seed phrases makes it a high-priority threat for immediate detection and mitigation.