Emerging Malware Families: WordlistLoader and SynkLoader Exposed
Recent research from cybersecurity experts has spotlighted two troubling malware families: WordlistLoader and SynkLoader. These malicious tools are reportedly being utilized to deliver subsequent payloads, potentially facilitating access for ransomware organizations.
Gen Digital’s findings reveal that WordlistLoader acts as a conduit for the distribution of Amatera Stealer, also known as ACR Stealer or AcridRain Stealer. This nefarious process operates through a series of sophisticated ClearFake campaigns, which cleverly employ techniques like ClickFix (or FakeCaptcha) to trick unsuspecting users into executing harmful commands under the guise of completing CAPTCHA verification.
Security researcher Vojtěch Krejsa explained, “Once a user checks the ‘I’m not a robot’ box, they navigate through a deceptive ClickFix flow. A malicious command is copied to their clipboard, and they are then prompted to paste it into their Windows Run dialog. This ultimately downloads WordlistLoader, leading to the execution of Amatera.”
The ClickFix prompts manifest on real websites that have fallen prey to malicious JavaScript injections. These injections often take the form of Base64-encoded blobs that retrieve additional JavaScript from a smart contract on the blockchain, a method termed EtherHiding. Several compromised websites reportedly serving ClickFix prompts include a mix of legal, hosting, and adult-oriented sites, indicating the widespread nature of this threat.
In recent months, these ClearFake campaigns have evolved to utilize “cdn.jsdelivr[.]net” for hosting the threat actors’ malicious JavaScript. This shift underscores the worrying trend of legitimate Content Delivery Networks (CDNs) being exploited for hosting and distributing harmful code. Expel noted this concerning trend in January, shedding light on the attackers’ adaptability. Although the CDN appears to be actively removing the malicious repositories, the use of EtherHiding allows these actors to easily swap out identified URLs.
The ClickFix mechanism employs “conhost” to initiate a hidden “cmd.exe” process, which subsequently maps a remote WebDAV share. This method finally executes the loader through “rundll32.exe.” It is crucial to note that this WebDAV-based approach aligns closely with another campaign recently brought to attention by Microsoft.
In Microsoft’s findings, a ClickFix prompt directs users to execute a command that triggers “cmd.exe,” which in turn launches “rundll32.exe” to load a Dynamic-Link Library (DLL) from a remote WebDAV share over HTTPS. This sequence has been categorized into three distinct command variants: direct rundll32 invocation, mounted WebDAV share execution followed by rundll32.exe, and obfuscated pushd execution leading to rundll32.exe, closely mirroring the WordlistLoader infection process.
Microsoft emphasized that in the more sophisticated versions of the malware, threat actors enhance their stealth by executing commands through conhost.exe, thus suppressing visible console windows and utilizing environmental variable obfuscation to conceal essential execution components. This level of sophistication complicates detection and static analysis, enabling attackers to carry out malicious activities with minimal warning to victims.
Moreover, the primary distinction observed was the transition from Python-based loaders, initially identified in connection to the ACR Stealer intrusion, to the new WordlistLoader. This indicates a notable evolution in the techniques used by cybercriminals.
The shellcode utilized by WordlistLoader is particularly concerning. Gen Digital reported that this code is represented as a sequence of plain English words. This inventive encoding method effectively masks the malware’s true intent, further complicating detection efforts. The shellcode eventually unpacks and loads Amatera 4.3.3-alpha1, leveraging a reflective loader—a technique that has been identified in previous ClickFix campaigns.
In a parallel realm of threats, SynkLoader has emerged as another potent cybersecurity adversary. Distributed through a phishing campaign linked to Microsoft Teams, this malware aims to extract user login credentials via a counterfeit lock screen. Detection of such activities was reported by Expel as early as mid-August 2025.
SynkLoader was notably disseminated using a seemingly legitimate communication from an IT service desk impersonating a Microsoft 365 domain, which instilled confidence in the target. The attacker convinced users to download a seemingly harmless MSI installer from a Microsoft Azure storage endpoint. This installer masquerades as a PowerShell Cleaner, extracting a ZIP archive and a PowerShell script that automatically executes upon being run.
Upon execution, the script launches a series of additional modules, including:
- System Profiler – A C# DLL designed to gather information about the compromised system.
- Persistence Module – A DLL that creates a scheduled task to ensure SynkLoader activates whenever the victim logs in.
- PhishLocker – A DLL that presents a fake Windows lock screen to capture user login details.
- TrafficRedirector – A reverse proxy allowing the attacker to access local network services.
- Interactive Shell – A remote access tool enabling command execution via PowerShell.
- StreamMaster – A VNC module for remote desktop streaming.
- Status Checker – A Python script that monitors and reports the operational status of the various modules.
While the specific objectives behind SynkLoader remain ambiguous, it is suspected that this toolkit may be closely affiliated with either a ransomware enterprise or serve as an entry point for initial access brokers.
In summary, the emergence of WordlistLoader and SynkLoader has shed light on the increasingly sophisticated tactics utilized by cybercriminals. As these malware families become more adept at bypassing traditional defenses, the urgency for enhanced cybersecurity measures has never been greater. The evolution of hacking techniques not only requires vigilance on the part of individuals but also calls for organizations to bolster their defenses against these evolving threats.