New ClickFix Attacks Use App-V Scripts to Distribute Amatera Malware
- Securityish
- Threats & Incidents
Quick Summary
A new ClickFix attack campaign utilizes fake CAPTCHA and signed Microsoft App-V scripts to deliver Amatera infostealing malware. This method leverages the legitimate SyncAppvPublishingServer.vbs script to execute PowerShell commands, tricking users into manual execution. The Amatera malware, which collects browser data and credentials, is part of a growing trend of sophisticated attacks that exploit trusted components to evade detection.
The Securityish Brief
The ClickFix attack campaign combines a fake CAPTCHA verification with a signed Microsoft Application Virtualization (App-V) script to deliver the Amatera infostealing malware. This method is notable as it marks the first instance of App-V scripts being used in ClickFix attacks. The attack begins with a fake CAPTCHA that instructs victims to execute a command in the Windows Run dialog, which abuses the legitimate SyncAppvPublishingServer.vbs script.
Once executed, the command uses the trusted wscript.exe binary to launch PowerShell. The attack verifies that the command was executed manually and checks for sandbox environments, stalling execution if detected. This careful execution strategy helps the malware evade automated analysis.
The malware retrieves configuration data from a public Google Calendar file, which contains base64-encoded values. Subsequently, a hidden PowerShell process is spawned using the Windows Management Instrumentation (WMI) framework, leading to the decryption and loading of multiple embedded payloads into memory.
In a further step, the attack employs steganography, embedding encrypted PowerShell payloads in PNG images hosted on public CDNs. This technique allows the malware to dynamically retrieve and execute payloads while remaining undetected.
Once active, the Amatera malware connects to a hardcoded IP address to gather endpoint mappings and awaits additional payloads via HTTP POST requests. Classified as an infostealer, Amatera is capable of collecting sensitive browser data and credentials from infected systems.
Researchers emphasize the need for organizations to restrict access to the Windows Run dialog through Group Policy, remove unnecessary App-V components, enable PowerShell logging, and monitor outbound connections for discrepancies between the HTTP Host header or TLS SNI and the destination IP.
- ClickFix: A method used to trick users into executing malicious commands.
- Microsoft App-V: An enterprise feature that allows applications to run in isolated environments.
- Amatera: An infostealer malware that collects sensitive browser data and credentials.
- PowerShell: A task automation and configuration management framework from Microsoft.
- Steganography: A technique used to hide data within other files, such as images.
Key Takeaways
- Restrict access to the Windows Run dialog via Group Policy to prevent unauthorized command execution.
- Remove Microsoft App-V components if they are not necessary for your organization.
- Enable PowerShell logging to monitor for suspicious activity and commands.
- Regularly check outbound connections for any discrepancies that could indicate malicious activity.
- Educate users about the risks of executing commands from untrusted sources.
Key Terms & Concepts
- ClickFix: In this article, ClickFix refers to a method used to trick users into executing malicious commands.
- Microsoft App-V: Microsoft App-V is an enterprise feature that allows applications to run in isolated environments without being installed on the system.
- Amatera: Amatera is an infostealer malware that collects sensitive browser data and credentials from infected systems.
- PowerShell: PowerShell is a task automation and configuration management framework from Microsoft that is often exploited in attacks.
- Steganography: Steganography is a technique used to hide data within other files, such as images, to evade detection.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-clickfix-attacks-abuse-windows-app-v-scripts-to-push-malware/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
