Novel ClickFix Chain Delivers Amatera Stealer

Industry researchers identified a sophisticated fake CAPTCHA campaign that leverages a signed Microsoft Application Virtualization (App-V) script, SyncAppvPublishingServer.vbs, as a LOLBIN to proxy execution through legitimate Windows components. The attack begins with ClickFix - a social engineering prompt instructing users to manually paste and execute a command via the Run dialog, framed as a human verification check. Instead of launching PowerShell directly, the command abuses the signed Microsoft script to avoid common detection paths and naturally filters out lower-value systems since App-V components are only present on Enterprise and Education editions of Windows.

The campaign employs multiple execution gates and validation mechanisms throughout its progression, including checking clipboard contents and environment variables to ensure proper execution order and user interaction. The attack chain pulls live configuration from a public Google Calendar file, allowing attackers to update delivery parameters without redeploying earlier stages. Later stages use PNG-based steganography to deliver encrypted payloads hidden inside images, which are extracted and executed entirely in memory. The chain ultimately delivers Amatera Stealer, a well-known information stealing malware that uses layered encryption, evasive networking techniques, and modular tasking capabilities. The malware establishes command and control communication using Host header spoofing and bypasses standard Windows networking libraries through direct syscalls to avoid EDR detection.