Amadey

Amadey is a malware-as-a-service loader and dropper first observed in 2018 and widely used as an initial-access component in cybercrime operations. It is primarily associated with Windows infections and is commonly used to compromise devices, establish persistence, profile the host, and deploy additional payloads including infostealers, remote access trojans, cryptominers, and ransomware. Amadey has repeatedly appeared in multi-stage intrusion chains alongside malware such as StealC and other commodity crimeware, making it a frequent enabler of credential theft, fraud, and downstream extortion activity.

The malware is mainly distributed through phishing campaigns, though it has also appeared in broader malware delivery ecosystems and bundled attack chains. Once executed, Amadey can persist on the infected system through registry modification and has been observed checking for installed antivirus products, indicating host reconnaissance and defense-evasion behavior before or during follow-on activity. It can retrieve sensitive information from compromised systems in addition to functioning as a payload delivery mechanism.

Operational reporting has linked Amadey to shared criminal infrastructure used with the StealC infostealer, and international law-enforcement actions under Operation Endgame disrupted infrastructure supporting both malware families. Amadey has also been referenced in activity associated with Kimsuky-linked intrusion chains, though its broader use is consistent with commodity cybercrime rather than exclusive use by a single threat actor. Its role in providing initial access and installing secondary malware has made it a recurring first-stage tool in financially motivated attacks against a wide range of victims.