WordlistLoader and SynkLoader Target Windows Credentials
Security researchers have identified two malware families aimed at gaining access to Windows environments: WordlistLoader, which delivers Amatera Stealer through ClickFix campaigns, and SynkLoader, which uses Microsoft Teams phishing and a fake Windows lock screen to collect login passwords. Gen Digital analysed WordlistLoader in ClearFake activity, while Expel detected SynkLoader activity in mid-August 2025.
WordlistLoader is an intermediate stage in the Amatera, also known as ACR Stealer or AcridRain Stealer, infection chain. Victims are shown a counterfeit CAPTCHA prompt on a legitimate but compromised website and are instructed to paste a malicious command into the Windows Run dialog. That action downloads the loader and ultimately executes Amatera.
ClickFix chain combines compromised sites and WebDAV
The ClickFix prompts are injected into compromised websites as Base64-encoded JavaScript. The code retrieves further JavaScript from a blockchain smart contract in an EtherHiding technique, then executes it dynamically. Recent ClearFake campaigns have also used the legitimate jsDelivr CDN to stage malicious PowerShell, while EtherHiding lets operators replace removed or unavailable URLs.
The command chain uses conhost to start a hidden cmd.exe process, maps a remote WebDAV share with pushd, and launches the loader through rundll32.exe. Microsoft documented related activity in which cmd.exe invoked rundll32.exe to load a DLL from a remote HTTPS-accessible WebDAV share. Its more concealed variant used conhost.exe with the headless option and delayed environment-variable expansion to obscure pushd, rundll32 and the remote host.
The shift to WordlistLoader replaced Python-based loaders observed by Microsoft between late April and mid-June 2026 in ACR Stealer intrusions. The broader Windows threat landscape also includes chains in which Lazarus SYSTEM access through a Windows zero-day demonstrates how attackers can obtain SYSTEM privileges before deploying a backdoor, increasing the value of detecting early execution steps.
Encoded shellcode and enhanced Amatera evasion
Gen Digital said WordlistLoader reconstructs shellcode that acts as the entry point for subsequent stages. Its name reflects a storage method in which every encoded shellcode byte is represented by a plain English word. Researchers also found a variant using an array of UUID-encoded chunks, each 16 bytes long.
The loader uses a hardware-breakpoint technique to bypass Event Tracing for Windows and reduce activity traces. A reflective loader then unpacks and loads Amatera. The same reflective loader appeared in an April 2026 ClickFix campaign delivering Amatera 4.3.3-alpha1, whose newer version added static obfuscation, syscall changes using the WoW64 transition and Heaven’s Gate, plus a redesigned application-bound encryption bypass apparently inspired by Remus Stealer.
SynkLoader uses Teams phishing for password capture
Separately, Expel observed an operator using an address in a company’s onmicrosoft.com domain and the display name IT Service Desk to persuade a target to install an MSI file from Microsoft Azure file storage. The installer presented itself as PowerShell Cleaner, extracted a ZIP archive and PowerShell script, and ran the script in memory.
That script launched a Python-based loader which selected one of three hard-coded command-and-control domains, checked in at random intervals, slept for 90 to 120 seconds between requests, and decrypted server responses for execution. Identified modules included system profiling, a scheduled-task persistence component, PhishLocker for a fake lock screen, a reverse proxy, a PowerShell remote-access module, VNC desktop control and a status checker.
Security teams should treat pasted CAPTCHA commands, unexpected Teams software requests, hidden command execution, WebDAV mappings and rundll32 launches as correlated investigation signals. Restricting unverified installers and validating IT support contacts can help prevent credential capture and remote-access deployment before an operator establishes persistence.