WordlistLoader and SynkLoader: New Malware Families Target Windows Users via ClickFix and Teams Phishing

Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, which are being used to deliver next-stage payloads and potentially sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is used to deliver Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) through ClearFake campaigns that employ the ClickFix (FakeCaptcha) technique. This method tricks victims into running malicious commands under the guise of completing CAPTCHA verification checks.

Once a victim clicks the ‘I’m not a robot’ checkbox, they are guided through the ClickFix flow, where a malicious command is copied to their clipboard and they are instructed to paste it into the Windows Run dialog. This leads to the download and execution of WordlistLoader, which ultimately runs Amatera. The ClickFix prompts are displayed on legitimate websites that have been compromised with malicious JavaScript, often injected as a Base64-encoded blob. This blob fetches another JavaScript from a smart contract stored on the blockchain, a technique known as EtherHiding, to dynamically execute the retrieved code.

Recent ClearFake campaigns have also abused the legitimate CDN ‘cdn.jsdelivr[.]net’ to host malicious PowerShell scripts. The ClickFix command uses ‘conhost’ to launch a hidden ‘cmd.exe’ process, map a remote WebDAV share using ‘pushd’, and then launch the loader via ‘rundll32.exe’. This WebDAV-based approach overlaps with a similar campaign highlighted by Microsoft, which noted three different command variants, including an advanced one that uses headless execution and environment variable obfuscation to enhance stealth.

WordlistLoader is an intermediate stage in the Amatera infection chain, designed to reconstruct shellcode that serves as the entry point for subsequent stages. It employs a hardware-breakpoint-based method to bypass Event Tracing for Windows (ETW) and avoid leaving traces. The shellcode uses a reflective loader to unpack and load Amatera, which has been updated with static obfuscation, hardened syscall invocation, and a redesigned application-bound encryption (ABE) bypass inspired by Remus Stealer.

In a separate campaign, SynkLoader has been distributed via Microsoft Teams phishing to steal system login credentials by serving a fake lock screen. The attacker, posing as IT Service Desk, convinces the user to install an MSI installer from Azure file storage. The installer presents itself as a PowerShell Cleaner, which extracts a ZIP archive and a PowerShell script that runs in memory. The loader then decrypts and executes responses from one of three hard-coded C2 domains. At least seven modules have been identified, including System Profiler, Persistence Module, PhishLocker, TrafficRedirector, Interactive Shell, StreamMaster, and Status Checker. The operator’s end goals are unclear, but it is suspected the toolkit may be part of a ransomware group or an initial access broker.