WordPress Campaign Uses Service Workers and EtherHiding to Deliver Amatera Stealer
Summary
Netskope details a WordPress compromise campaign that uses persistent Service Workers, an on-chain payload, and a ClickFix lure to deliver Amatera, which steals credentials and system data.
Key points
- A rogue WordPress plugin registers a Service Worker that persists in visitors’ browsers, removes CSP headers, and injects malicious code while hiding the lure from logged-in site administrators.
- The injected script retrieves its payload from a mutable smart contract on Base, enabling the operator to change downstream hosts without modifying compromised sites.
- A fake reCAPTCHA prompts Windows visitors to paste an mshta command, which fetches an MP3/HTA polyglot from timelevel12[.]com.
- The attack uses a scheduled task, PowerShell with AMSI and Constrained Language Mode bypasses, the Emmenhtal loader, and a payload hidden in an image on i[.]ibb[.]co.
- The final Amatera password stealer exfiltrates credentials and system data; its command-and-control lookups use DNS-over-HTTPS.
- Netskope recommends blocking campaign infrastructure, explicitly removing Service Workers during remediation, and monitoring the Base contract for payload changes.
Article Details
- Attack Vectors
- A rogue WordPress must-use plugin installs a Service Worker that persists in visitors’ browsers, removes CSP headers, and injects a script.
- The injected script retrieves a fake reCAPTCHA lure from a Base smart contract and uses ClickFix to persuade visitors to paste an mshta command into Windows Run.
- mshta retrieves an MP3/HTA polyglot whose embedded HTA creates a scheduled task and launches PowerShell.
- PowerShell bypasses AMSI and Constrained Language Mode, then loads the Emmenhtal loader and a steganographic image-hosted payload in memory.
- The final Amatera payload steals credentials and system data, exfiltrates them, and communicates with its C2 over DNS-over-HTTPS.
- Defensive Notes
- Block the beacon and stage-2 host at the network layer.
- During remediation, explicitly unregister malicious Service Workers and delete their caches; removing compromised site files alone does not remove the browser registration.
- Monitor the identified Base contract for payload rotation and inspect blockchain traffic for contract reads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gw[.]proxyvector[.]cc | Amatera command-and-control host, resolved over DNS-over-HTTPS. |
| MD5 | c729d236e5e4886753e41388c979d50c | MD5 hash of the malicious nochain-sw.js Service Worker loader. |
| SHA256 | 166ba96c5661235ceeb2cec233dd9464ca02d2a4c1db57de0a6b69da97a00337 | Hash of the Amatera password stealer, disguised as WPA.exe. |
| SHA256 | 2ca3951d34d7232642caf02c9683a0880e947a3251031aea931977ce761a4600 | Hash of the steganographic JPEG containing the encrypted payload. |
| SHA256 | 7f05d1b7a679b47e6c19ccb319a1713d1e2c3440e2bc6878dc51a2cb4899333a | Hash of x86 shellcode containing the encrypted Amatera PE. |
| SHA256 | 8dd49a4f0e68e9c9373c4ce52656bf302eba28f0f4d2f5e9ce165fb47ffd745d | Hash of the malicious nochain-sw.js Service Worker loader. |
| SHA256 | a8c5429c15654de48072327e196b199910e7bc373b9713727df0d90f667092b5 | Hash of the malicious stage-2 MP3/HTA polyglot. |
| SHA256 | ae3eb045702c97247e353a2a0ce7394e6116055e58a4356c8931fe7143363aff | Hash of the malicious stage-3 Emmenhtal loader. |
| URL | hxxp[:]//timelevel12[.]com/big | Stage-2 MP3/HTA payload URL fetched through the ClickFix mshta command. |
| URL | hxxps[:]//gpuh[.]gravityzone[.]army/019c7f42-5ab8-701d-ae93-824fc6157b30 | Stage-3 Emmenhtal download URL on a host identified as impersonating Bitdefender GravityZone. |
| URL | hxxps[:]//i[.]ibb[.]co/3ytBLkY6/init-block[.]jpg | Specific image URL identified as hosting the steganographic payload used by Emmenhtal. |
| URL | hxxps[:]//ultraspeed[.]pro/collect | Encrypted telemetry beacon endpoint used by both campaign delivery lanes. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe embedded HTA creates the serviceerg scheduled task with a one-second trigger for persistence.T1059.001 · PowerShellThe scheduled task launches PowerShell, which executes the fileless next stage.T1071.004 · DNSAmatera resolves its C2 host over DNS-over-HTTPS.T1218.005 · MshtaThe victim-run command invokes mshta to fetch and execute the embedded HTA in an MP3/HTA polyglot.T1562.001 · Disable or Modify ToolsThe PowerShell stage patches amsiContext to blind AMSI and bypasses Constrained Language Mode.
Malware
ACRStealerOnce we unpacked the final payload, multiple AV engines confirmed it is Amatera, which Proofpoint identifies as a rebrand of ACR Stealer (AcridRain), a native Win32 PE32 x86 password stealer, disguised as WPA.exe.Amaterapolyglot file, mshta abuse, a fileless PowerShell stage, an image-hidden loader, and finally the Amatera password stealer.EmmenhtalG["Emmenhtal loader<br/>gpuh.gravityzone[.]army"]
Products
BaseThat worker strips the site’s Content-Security-Policy header and injects a script that reads its payload from a smart contract on Base.Microsoft WindowsIn turn, the smart contract serves a fake reCAPTCHA telling the visitor to paste a command into the Windows Run dialog.WordPressNetskope Threat Labs has been tracking a WordPress mass-compromise campaign affecting hundreds of sites.