Malware

SynkLoader

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 24, 2026 · last 20d ago

Timeline2 articles

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Gen Digital details WordlistLoader delivering Amatera Stealer via ClickFix and EtherHiding, while SynkLoader phishes Windows credentials through Microsoft Teams.

Gen Digital identified WordlistLoader, an intermediate stage that reconstructs shellcode encoded as plain English words (or 16-byte UUID chunks) and loads Amatera Stealer 4.3.3-alpha1, delivered through ClearFake ClickFix prompts on compromised websites. The chain uses EtherHiding to fetch JavaScript from a blockchain smart contract, hidden cmd.exe via conhost, WebDAV-mounted shares with rundll32 execution, and ETW bypass via hardware breakpoints. The stealer adds hardened WoW64 syscalls, Heaven's Gate indirect-syscall trampolines and a redesigned application-bound encryption bypass. Separately, Expel observed SynkLoader distributed via Microsoft Teams phishing impersonating IT service desks, installing an MSI from Azure blob storage and serving a fake lock screen to capture credentials.

The Hacker NewsAug 26, 05:08 UTC · 20d agoMalware

Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.

Dark Reading reports analysis of SynkLoader, an advanced, multilingual malware family functioning as a multitool loader. The family revives an older technique — screen hijacking — to enable effective password theft, alongside several novel features. Analysts assess its activity may be a precursor to ransomware deployments, making early detection valuable for defenders.

Dark ReadingAug 24, 15:02 UTC · 22d agoMalware

Appears with

malware ACR Stealer 1 malware Amatera Stealer 1 malware WordlistLoader 1 organization Dark Reading 1 organization Expel 1 organization Gen Digital 1 organization Microsoft 1 product Microsoft 365 1 product Microsoft Teams 1 vendor Expel 1 vendor Gen Digital 1 vendor Microsoft 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.