WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Gen Digital details WordlistLoader delivering Amatera Stealer via ClickFix and EtherHiding, while SynkLoader phishes Windows credentials through Microsoft Teams.
Gen Digital identified WordlistLoader, an intermediate stage that reconstructs shellcode encoded as plain English words (or 16-byte UUID chunks) and loads Amatera Stealer 4.3.3-alpha1, delivered through ClearFake ClickFix prompts on compromised websites. The chain uses EtherHiding to fetch JavaScript from a blockchain smart contract, hidden cmd.exe via conhost, WebDAV-mounted shares with rundll32 execution, and ETW bypass via hardware breakpoints. The stealer adds hardened WoW64 syscalls, Heaven's Gate indirect-syscall trampolines and a redesigned application-bound encryption bypass. Separately, Expel observed SynkLoader distributed via Microsoft Teams phishing impersonating IT service desks, installing an MSI from Azure blob storage and serving a fake lock screen to capture credentials.
- ClickFix flow disguises malicious commands as CAPTCHA verification pasted into the Windows Run dialog.
- Compromised sites include abogadosrosarinos.com, aptisweb.com and avene-hebergement.com; jsDelivr CDN used to stage PowerShell.
- Reflective loader unpacks Amatera 4.3.3-alpha1, echoing a late-April 2026 ClickFix campaign.
- SynkLoader used onmicrosoft.com sender addresses and Azure file storage (filereserve.blob.core.windows.net) to appear Microsoft-legitimate.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 Malicious FileT1059.001 PowerShellT1562.001 Impair Defenses: Disable or Modify ToolsT1105 Ingress Tool Transfer
- Vendors
- Gen DigitalExpelMicrosoft
- Products
- Microsoft TeamsMicrosoft 365
- Organizations
- Gen DigitalExpelMicrosoft
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.