Security researchers have reported two newly identified malware families: WordlistLoader and SynkLoader. Both are designed to move attackers closer to their ultimate objectives by either delivering a next-stage payload or harvesting credentials through a convincing social-engineering route. While the families focus on different stages and techniques, the overall pattern is clear: attackers are investing in stealthy delivery chains and user-manipulation tactics.
Below, we break down how each family works, what delivery methods were observed, and why these campaigns matter for organizations that want to reduce the risk of stealer infections and account takeover.
What makes WordlistLoader and SynkLoader notable
WordlistLoader and SynkLoader differ in purpose and distribution, but they share a key theme—getting code to execute while minimizing detection. In the WordlistLoader case, the initial step relies on compromised websites and ClickFix-style browser prompts that trick victims into running malicious commands. For SynkLoader, the entry point is a Microsoft Teams phishing lure that leads the victim to install an MSI package and ultimately face a fake login experience.
Researchers also believe these tools may support broader criminal goals. In the WordlistLoader chain, the end target is associated with stealing activity, and it is suspected that access may later be sold or used for ransomware-related operations. For SynkLoader, the toolset’s modules suggest credential theft as a starting point, with possible follow-on uses.
How WordlistLoader delivers Amatera through ClickFix
Gen Digital researchers linked WordlistLoader and SynkLoader to separate intrusion paths, and the WordlistLoader trail specifically targets delivery of the Amatera Stealer (also referenced under names like ACR Stealer or AcridRain Stealer). The observed delivery method uses ClearFake campaigns and a ClickFix technique (also known as FakeCaptcha).
In these attacks, victims encounter a prompt on a website that appears to request CAPTCHA verification. Once the user clicks the “I’m not a robot” checkbox, the flow guides them into copying and pasting a command into the Windows Run dialog. That command then triggers the download and execution of WordlistLoader, which ultimately leads to the stealer payload execution.
Security researcher Vojtěch Krejsa described the critical behavioral trick: the attacker’s instructions are crafted so the command is copied to the clipboard after the checkbox click, then executed by the victim themselves. This design leverages normal user behavior to accelerate execution and reduce the need for loud exploitation.
Compromised websites and injected JavaScript
The ClickFix prompts are not just served by a generic landing page. Instead, compromised websites include malicious JavaScript injected into the site. Researchers reported that the injected code is delivered as a Base64-encoded blob, which then fetches additional JavaScript from a “smart contract stored on the blockchain.” This retrieval technique was referred to as EtherHiding, and the retrieved code is executed dynamically.
Examples of sites reported as serving ClickFix prompts included:
- abogadosrosarinos[.]com
- aptisweb[.]com
- avene-hebergement[.]com
- https-xhamster[.]com
- www.caesarjaco.co[.]id
- skybap[.]shop
Campaign infrastructure also evolved. Researchers noted that ClearFake operators shifted toward hosting malicious JavaScript via cdn.jsdelivr[.]net. This matters because jsDelivr is a legitimate CDN, and abusing trusted hosting can help attackers blend in during early-stage delivery.
Expel previously observed that, although a CDN is meant for JavaScript hosting, the attackers used it to stage malicious PowerShell scripts. Even when repositories are taken down quickly, the EtherHiding approach was said to make it easier to swap to fresh working resources.
The ClickFix command chain: conhost, WebDAV, and rundll32
The WordlistLoader execution path involves a multi-step Windows command chain. The ClickFix instruction uses conhost to start a hidden cmd.exe process. It then maps a remote WebDAV share using pushd, and finally launches the loader via rundll32.exe.
Researchers also pointed out overlap with previously reported campaigns involving Microsoft guidance. In those observed variants, the user-facing prompt would instruct execution that eventually loads a DLL from a remote WebDAV share over HTTPS using rundll32.
Three command variants were recorded:
- Direct rundll32 invocation
- pushd-mounted WebDAV share followed by rundll32.exe invocation
- A headless, obfuscated pushd execution path followed by rundll32.exe invocation (aligned with the WordlistLoader infection chain)
In a more advanced version, attackers attempted to increase stealth by launching commands through conhost.exe with a headless setting. They also suppressed visible console windows and used environment-variable obfuscation with delayed variable expansion to conceal key components like pushd, rundll32, and the remote host name. Microsoft noted that these changes can reduce user visibility and complicate static analysis and detection.
From encoded wordlists to shellcode and reflective loading
A central detail behind the name WordlistLoader and SynkLoader is how WordlistLoader prepares its next stage. Gen Digital reported that the loader reconstructs shellcode that functions as an entry point for subsequent payload handling. The shellcode is stored in an encoded form as a sequence of plain English words, with each word representing a single byte.
Researchers also found a variant that replaced the wordlist mechanism with an array of 16-byte UUID-encoded chunks. After reconstruction, the shellcode uses a reflective loader to unpack and load Amatera.
The reflective loader itself was seen in earlier ClickFix-related activity described as delivering Amatera 4.3.3-alpha1. This suggests the campaign operators reuse proven components while swapping or upgrading the delivery stage as needed.
Gen Digital further reported enhancements in the latest stealer version. Updates included:
- Revised static obfuscation
- Hardened syscall invocation through the WoW64 transition
- Dynamically generated x64 indirect-syscall trampolines using Heaven’s Gate
- A redesigned application-bound encryption (ABE) bypass, apparently inspired by Remus Stealer
SynkLoader: credential theft via Microsoft Teams phishing
While WordlistLoader focuses on delivering the stealer payload after a user executes a malicious command, SynkLoader takes a different approach: it is distributed via a Microsoft Teams phishing campaign designed to obtain login credentials.
Expel detected the activity in mid-August 2025. The lure started when someone reached out to the victim using a Microsoft 365 style account name format, and they posed as an IT helpdesk using a name like “IT Service Desk.” The goal was to persuade the user to download and install an MSI installer from attacker-controlled storage hosted on Microsoft Azure file storage endpoints.
The MSI installer pretended to be a “PowerShell Cleaner.” When executed, it extracted a ZIP archive and a PowerShell script. The PowerShell script was automatically run in memory, then used to unpack the archive and launch a Python-based loader.
Randomized check-ins and module-based capability
The Python loader was described as selecting one of three hard-coded command-and-control (C2) domains. It would then reach out to the server at random intervals, sleeping for about 90 to 120 seconds between requests. Responses from the server were decrypted and executed.
Researchers identified at least seven modules within the SynkLoader toolkit:
- System Profiler: a C# DLL that collects data about the target system.
- Persistence Module: a native DLL that creates a scheduled task with a randomized name to start SynkLoader at login and daily at 10 a.m.
- PhishLocker: a DLL that serves a fake Windows lock screen to capture a user’s login password.
- TrafficRedirector: a backconnect or reverse proxy to enable attacker access to local services or route traffic through the infected machine.
- Interactive Shell: a remote access trojan (RAT) component to run PowerShell commands and send results back.
- StreamMaster: a VNC module that streams the victim’s desktop and enables remote mouse and keyboard control.
- Status Checker: a Python script that reports which modules are currently running.
What the operators ultimately plan for can’t be confirmed from the findings alone. However, researchers suspected SynkLoader could support a ransomware group or act as an initial access broker by enabling credential theft and broader remote control.
Why these delivery chains matter for defenses
Both incidents highlight how attackers combine user manipulation with technical execution chains. ClickFix-based prompts reduce the barrier to running commands because the victim is coached into execution through clipboard-based instructions. In SynkLoader’s case, the fake lock screen focuses on harvesting credentials after an MSI and in-memory script delivery.
Defensively, this means organizations can’t rely on a single layer of protection. Blocking known phishing paths, reducing the ability for web content to trigger deceptive workflows, monitoring for unusual command execution patterns, and restricting outbound communications from user endpoints are all relevant considerations.
It also underscores the value of incident response readiness: once attackers reach execution, module-driven toolkits can rapidly expand capabilities from credential capture to remote access and persistence.
Conclusion
WordlistLoader and SynkLoader represent two distinct but complementary threats. WordlistLoader delivers Amatera via ClickFix-style prompts that lead victims to execute a command chain leveraging conhost, WebDAV mapping, and rundll32—ultimately reconstructing encoded shellcode for reflective loading. SynkLoader, in contrast, uses a Microsoft Teams phishing path that delivers an MSI and in-memory script sequence, then activates modules for persistence, desktop streaming, and password collection through a fake lock screen.
Understanding these chains helps defenders anticipate attacker behavior earlier—before stealer payloads run or credentials are captured—so security teams can respond faster and more effectively.
Source: https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html
