WordlistLoader Deploys Amatera via ClickFix While SynkLoader Phishes Windows Passwords

Key Takeaways

• Two new malware families, WordlistLoader and SynkLoader, are being used as intermediate loaders to deliver next‑stage payloads such as the Amatera Stealer and credential‑stealing modules.
• WordlistLoader is distributed via ClickFix/FakeCaptcha campaigns that abuse compromised websites, EtherHiding on blockchain smart contracts, and legitimate CDNs like jsDelivr to host malicious PowerShell scripts.
• The infection chain uses a series of stealthy techniques—hidden conhost processes, headless command execution, WebDAV share mounting, and environment‑variable obfuscation—to evade detection and analysis.
• WordlistLoader reconstructs shellcode stored as plain English words (or UUID‑encoded chunks) and employs a reflective loader to unpack and execute Amatera 4.3.3‑alpha1, incorporating advanced anti‑ETW measures and Heaven’s Gate indirect syscalls.
• SynkLoader is delivered through a Microsoft Teams phishing lure that tricks victims into installing a malicious MSI masquerading as a PowerShell Cleaner; it then deploys a modular Python‑based loader with capabilities ranging from system profiling to VNC‑based remote control.
• Both loaders exhibit characteristics typical of initial‑access brokers or ransomware affiliates, suggesting the ultimate goal may be to sell access to ransomware groups or to facilitate data‑exfiltration and lateral movement.

Overview of WordlistLoader
WordlistLoader functions as an intermediate stage in the infection chain that ultimately delivers the Amatera Stealer (also known as ACR Stealer or AcridRain Stealer). Rather than delivering the final payload directly, it first reconstructs a piece of shellcode that serves as the entry point for subsequent stages. The loader’s name derives from its unique method of encoding that shellcode: each byte of the shellcode is represented by a plain‑English word taken from a wordlist, allowing the malicious code to hide in seemingly innocuous text. A variant observed by researchers substitutes the wordlist with an array of 16‑byte UUID‑encoded chunks, further complicating static analysis. Once reconstructed, the shellcode invokes a reflective loader that unpacks and executes Amatera 4.3.3‑alpha1 in memory, minimizing on‑disk footprints.

ClickFix/FakeCaptcha Delivery Mechanism
The primary vector for WordlistLoader is the ClickFix (aka FakeCaptcha) technique. Victims visiting compromised legitimate websites encounter a prompt that mimics a CAPTCHA verification—typically an “I’m not a robot” checkbox. Upon clicking, a malicious command is copied to the clipboard and the user is instructed to paste it into the Windows Run dialog and execute it. This social‑engineering step tricks users into launching a PowerShell script that downloads WordlistLoader. The ClickFix prompts are injected into sites via malicious JavaScript stored as a Base64‑encoded blob; the blob fetches additional JavaScript from a smart contract on the blockchain (EtherHiding), which then dynamically executes the attacker’s code.

Abuse of Legitimate Infrastructure
Recent iterations of ClickFix campaigns have leveraged the popular Content Delivery Network jsDelivr (cdn.jsdelivr.net) to host the malicious PowerShell script. While jsDelivr is intended for benign JavaScript libraries, threat actors upload their PowerShell payloads there, taking advantage of its reputation and global distribution. Although jsDelivr promptly removes identified malicious repositories, the use of EtherHiding enables actors to swiftly replace burned URLs with fresh ones hosted on the blockchain, maintaining persistence despite takedown efforts.

Stealthy Execution Chain
The ClickFix command follows a multi‑stage process designed to evade detection: it launches a hidden conhost process, which in turn starts a concealed cmd.exe session. The script then uses pushd to map a remote WebDAV share over HTTPS and finally invokes rundll32.exe to load a DLL from that share. Three observed variants differ in how the WebDAV share is mounted and obscured: a direct rundll32 call, a pushd‑mounted share followed by rundll32, and a headless, obfuscated pushd execution that suppresses console windows and uses delayed variable expansion to hide critical components such as pushd, rundll32, and the remote hostname. These tactics reduce user visibility, hinder static analysis, and bypass many endpoint‑detection rules that rely on visible command‑line activity.

ETW Evasion and Advanced Loader Features
WordlistLoader incorporates a hardware‑breakpoint‑based method to bypass Event Tracing for Windows (ETW), preventing the generation of typical telemetry that security solutions rely on for detecting malicious behavior. After reconstructing the shellcode, it employs a reflective loader responsible for unpacking and loading Amatera 4.3.3‑alpha1. The stealer itself has been updated with static obfuscation, hardened syscall invocation via the WoW64 transition, dynamically generated x64 indirect‑syscall trampolines accessed through Heaven’s Gate, and a redesigned application‑bound encryption (ABE) bypass that appears inspired by Remus Stealer. These enhancements make the malware harder to detect with signature‑based tools and increase its resilience against analysis environments.

Technical Comparison with Prior ACR Stealer Campaigns
Earlier campaigns distributing ACR Stealer relied on Python‑based loaders observed between late April 2026 and mid‑June 2026. Those loaders used MSHTA to retrieve remote HTA content, which then executed a VBScript loader that fetched a JPEG image from an image‑hosting service, extracted the stealer payload in memory, and minimized on‑disk artifacts. WordlistLoader replaces the Python loader with its wordlist‑encoded shellcode approach, representing an evolution toward even more obscure encoding methods while preserving the core goal of delivering Amatera Stealer with minimal detectable footprint.

Overview of SynkLoader
SynkLoader is a separate malware family discovered in mid‑August 2025, distributed via a Microsoft Teams phishing campaign. The attack begins with a message from an address ending in @.onmicrosoft.com, posing as the “IT Service Desk.” The sender convinces the target to download and install an MSI installer hosted on an Azure Blob Storage endpoint (https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi). The MSI is presented as a PowerShell Cleaner, lending it an air of legitimacy.

Infection Process and Payload Deployment
When executed, the MSI extracts a ZIP archive and a PowerShell script that runs entirely in memory. The script unpacks the archive and launches a Python‑based loader. This loader contacts one of three hard‑coded command‑and‑control (C2) domains at random intervals, sleeping 90–120 seconds between requests to blend with normal traffic. Upon receiving a response, the loader decrypts and executes the returned payload, which consists of several modular components designed for persistence, credential theft, lateral movement, and remote control.

Modular Capabilities of SynkLoader
At least seven distinct modules have been identified within the SynkLoader toolkit:

1. System Profiler – a C# DLL that gathers detailed information about the infected host (OS version, hardware, installed software, network configuration).
2. Persistence Module – a native DLL that creates a randomly named scheduled task, ensuring SynkLoader runs at user logon and daily at 10 a.m.
3. PhishLocker – a DLL that presents a fake Windows lock screen to capture the victim’s login password.
4. TrafficRedirector – a back‑connect or reverse proxy that lets attackers pivot to internal network services or route external traffic through the compromised machine.
5. Interactive Shell – a remote access trojan (RAT) module enabling execution of arbitrary PowerShell commands and exfiltration of results.
6. StreamMaster – a VNC‑based module that streams the victim’s desktop and accepts remote mouse and keyboard input.
7. Status Checker – a Python script that reports which modules are currently active, allowing the C2 to adapt its commands in real‑time.

These capabilities collectively give attackers deep visibility, credential harvesting, persistent access, and the ability to move laterally within a victim’s environment.

Attribution and Potential End Goals
While the exact motives of the operators remain unclear, the modular nature of SynkLoader—especially the inclusion of a credential‑harvesting lock screen, a reverse proxy, and a full‑featured RAT—suggests it may function as an initial‑access broker or as part of a ransomware affiliate’s toolkit. By stealing login credentials and establishing covert communication channels, the threat actors could sell access to ransomware groups, enabling them to deploy encryptors without needing to develop their own intrusion infrastructure. Alternatively, the data collected could be used for extortion, espionage, or further credential‑stuffing attacks.

Defensive Implications
Both WordlistLoader and SynkLoader illustrate how attackers increasingly blend social engineering (ClickFix/FakeCaptcha and Teams phishing) with abuse of trusted services (blockchain smart contracts, CDNs, Azure storage) and advanced evasion tactics (headless execution, ETW bypass, reflective loading, encoded shellcode). Organizations should prioritize:

• User training to recognize fraudulent CAPTCHA prompts and unsolicited MSI installers, even when they appear to originate from legitimate domains.
• Network monitoring for abnormal WebDAV traffic, outbound HTTPS connections to unfamiliar domains, and scheduled tasks with random names.
• Endpoint controls that block the execution of scripts from temporary locations, restrict the use of rundll32 with unverified DLLs, and detect reflective‑loader techniques.
• Threat‑intelligence feeds that track newly observed domains associated with jsDelivr abuse, Ethereum contract addresses used for EtherHiding, and known C2 endpoints for SynkLoader.

By combining awareness, layered defenses, and continuous monitoring, defenders can reduce the likelihood of these sophisticated loaders achieving a foothold in their environments.