CyberSecurityBoardThreat Intel · CVEs · Products
Malware

WordlistLoader: A New Loader Delivering Amatera Stealer

August 24, 2026

WordlistLoader is an intermediate-stage malware loader used in ClearFake campaigns to deliver Amatera Stealer. It reconstructs shellcode from a wordlist or UUID-encoded chunks, bypasses ETW using hardware breakpoints, and employs a reflective loader to execute the final payload.