Recent cybersecurity investigations have uncovered two new malware families, WordlistLoader and SynkLoader, which are being leveraged to deploy subsequent malicious payloads and potentially facilitate ransomware activities. As reported by Gen Digital, WordlistLoader is implicated in the distribution of Amatera Stealer through ClearFake campaigns, employing a tactic known as ClickFix to deceive users into executing harmful commands under the guise of CAPTCHA verification.
Understanding the WordlistLoader Threat
WordlistLoader operates by tricking users into copying and pasting malicious commands after clicking on a seemingly harmless ‘I’m not a robot’ checkbox. This process involves the execution of WordlistLoader, which subsequently initiates the Amatera Stealer. According to Vojtěch Krejsa, a security researcher, this threat is presented through compromised websites embedded with malicious JavaScript using Base64 encoding. This script retrieves additional JavaScript via a smart contract on the blockchain, a technique known as EtherHiding.
Compromised websites involved in this scheme include domains such as abogadosrosarinos[.]com and aptisweb[.]com. These sites host ClickFix prompts that are designed to manipulate users into executing commands that facilitate malware installation. The abuse of legitimate Content Delivery Networks (CDNs) like “cdn.jsdelivr[.]net” for hosting malicious scripts showcases an evolving threat landscape.
Advanced Techniques and New Variants
WordlistLoader employs a sophisticated infection chain, utilizing conhost to start a concealed cmd.exe process, mapping remote WebDAV shares, and ultimately launching the loader via rundll32.exe. Microsoft’s recent findings indicate that similar WebDAV-based campaigns have been observed, indicating a broader trend in these attack strategies. These campaigns involve various command versions that complicate detection and analysis by using headless execution and environment variable obfuscation.
Additionally, WordlistLoader’s shellcode is encoded as English words, each representing a byte, which complicates analysis. This malware also features a reflective loader for unpacking Amatera and bypasses detection mechanisms using hardware-breakpoint-based methods.
SynkLoader’s Phishing Tactics
Meanwhile, SynkLoader has been involved in a phishing campaign targeting Microsoft Teams users, aiming to harvest login credentials by displaying a counterfeit lock screen. As identified by Expel in mid-August 2025, attackers posing as IT service desks convinced users to download an MSI installer from a Microsoft Azure endpoint, masquerading as a PowerShell Cleaner.
This installer extracts a ZIP archive and a PowerShell script that executes in memory, launching a Python-based loader. This loader communicates with command-and-control domains, executing server responses with various modules designed for data collection, persistence, and remote access, among others.
These sophisticated methods highlight the persistent threat posed by these malware families and underscore the importance of robust cybersecurity measures to protect against evolving tactics.
As these threats continue to develop, cybersecurity experts emphasize the need for vigilance and proactive defenses to mitigate the risks posed by WordlistLoader, SynkLoader, and similar malware.
