WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
WordlistLoader is a new malware loader delivering Amatera Stealer via ClearFake ClickFix campaigns, encoding shellcode as sequences of plain English words (one word per byte) or UUID-encoded chunks SynkLoader is distributed through Microsoft Teams phishing impersonating IT Service Desk, using fake MSI installers from Azure storage to steal Windows credentials via a fake lock screen Threat actors increasingly abuse legitimate infrastructure (jsDelivr CDN, Azure file storage, blockchain smart cont
Analysis
TL;DR
- WordlistLoader is a new malware loader delivering Amatera Stealer via ClearFake ClickFix campaigns, encoding shellcode as sequences of plain English words (one word per byte) or UUID-encoded chunks
- SynkLoader is distributed through Microsoft Teams phishing impersonating IT Service Desk, using fake MSI installers from Azure storage to steal Windows credentials via a fake lock screen
- Threat actors increasingly abuse legitimate infrastructure (jsDelivr CDN, Azure file storage, blockchain smart contracts via EtherHiding) to stage and rotate malicious payloads
- Amatera Stealer has evolved with hardened syscall invocation through WoW64 transition, Heaven's Gate indirect-syscall trampolines, and a redesigned application-bound encryption bypass inspired by Remus Stealer
- WordlistLoader bypasses Event Tracing for Windows (ETW) using hardware breakpoints and reconstructs shellcode in memory to minimize on-disk artifacts and complicate detection
Why It Matters
This article highlights the rapid evolution of malware delivery chains that combine social engineering (ClickFix, phishing) with sophisticated evasion techniques, making detection increasingly difficult for security teams. The shift from Python-based loaders to custom-built WordlistLoader demonstrates how threat actors are professionalizing their tooling, while the abuse of legitimate cloud infrastructure (Azure, CDN, blockchain) blurs the line between benign and malicious activity. For AI and cybersecurity practitioners, understanding these techniques is critical for improving detection models and defensive strategies against next-generation malware campaigns.
Technical Details
- WordlistLoader infection chain: ClickFix prompts on compromised websites inject Base64-encoded JavaScript that fetches additional code from blockchain smart contracts (EtherHiding). The command uses
conhostto launch a hiddencmd.exe, maps a remote WebDAV share viapushd, and executes the loader throughrundll32.exe - Shellcode encoding: WordlistLoader stores shellcode as plain English words (each representing one byte) or 16-byte UUID-encoded chunks, then reconstructs the shellcode in memory using a reflective loader to unpack and execute Amatera
- Amatera Stealer capabilities: Latest version features updated static obfuscation, hardened syscall invocation through WoW64 transition, dynamically generated x64 indirect-syscall trampolines via Heaven's Gate, and a redesigned application-bound encryption (ABE) bypass inspired by Remus Stealer
- ETW bypass: WordlistLoader employs a hardware-breakpoint-based method to bypass Event Tracing for Windows, preventing traces of malicious activity from being logged
- SynkLoader delivery: Phishing emails impersonate IT Service Desk using Microsoft 365 default domains, directing victims to download MSI installers from Azure file storage endpoints that appear legitimate, which then serve a fake Windows lock screen to harvest credentials
Industry Insight
- Security teams should prioritize monitoring for ClickFix-style social engineering attacks and implement user awareness programs specifically targeting the "fake CAPTCHA" technique, as this remains a highly effective initial access vector
- The increasing reliance on legitimate cloud infrastructure (Azure, CDN, blockchain) for payload hosting means traditional perimeter-based detection is insufficient; organizations need cloud-native detection capabilities and behavioral monitoring to identify abuse of trusted services
- The evolution of Amatera Stealer with Heaven's Gate techniques and ABE bypasses suggests ransomware groups are investing heavily in evasion research; defenders should update detection signatures and consider memory-focused analysis tools rather than relying solely on disk-based scanning
Disclaimer: The above content is generated by AI and is for reference only.