Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, being used to deliver next-stage payloads and likely sell access to ransomware groups. WordlistLoader is used to distribute Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) through ClearFake campaigns that leverage the ClickFix (FakeCaptcha) technique. SynkLoader is focused on phishing Windows credentials. Both loaders represent an evolving threat landscape where initial access brokers use stealthy delivery mechanisms to compromise victims before handing off access to ransomware operators. The campaigns highlight continued abuse of social engineering techniques like fake CAPTCHA pages to trick users into executing malicious code. Gen Digital researchers flagged these threats as part of ongoing monitoring of loader-based malware ecosystems.
Two new malware families have been identified: WordlistLoader and SynkLoader. **WordlistLoader / Amatera Stealer Chain:** - Delivered via ClearFake campaigns using the ClickFix (FakeCaptcha) technique. - Compromised websites inject Base64-encoded malicious JavaScript that fetches additional JavaScript from a smart contract on the blockchain (EtherHiding technique). - ClearFake campaigns abuse cdn.jsdelivr[.]net to host malicious JavaScript/PowerShell scripts. - ClickFix flow: victim clicks 'I'm not a robot' checkbox, malicious command is copied to clipboard, victim pastes it into the Windows Run dialog. - Command uses 'conhost.exe --headless' to launch a hidden 'cmd.exe', maps a remote WebDAV share using 'pushd', then launches the loader via 'rundll32.exe'. - Three command variants recorded: direct rundll32 invocation; pushd-mounted WebDAV share + rundll32; headless/obfuscated pushd + rundll32 (matching WordlistLoader chain). - Environment variable obfuscation with delayed variable expansion conceals pushd, rundll32, and remote hostname. - WordlistLoader reconstructs shellcode stored as a sequence of plain English words (each word = one byte); a UUID-encoded variant also exists (16-byte UUID chunks). - WordlistLoader uses hardware-breakpoint-based ETW bypass to avoid telemetry traces. - Shellcode invokes a reflective loader to unpack and load Amatera Stealer. - Amatera Stealer latest version features: updated static obfuscation, WoW64 transition for hardened syscall invocation, dynamically generated x64 indirect-syscall trampolines via Heaven's Gate, redesigned application-bound encryption (ABE) bypass inspired by Remus Stealer. - Earlier intrusion chains used Python-based loaders and MSHTA-triggered VBScript that fetched JPEG-embedded payloads from image-hosting services. **SynkLoader Chain:** - Distributed via Microsoft Teams phishing using a compromised or spoofed onmicrosoft.com account posing as 'IT Service Desk'. - Victim is convinced to download an MSI installer from a Microsoft Azure Blob Storage endpoint. - MSI presents itself as 'PowerShell Cleaner'; extracts a ZIP archive and auto-executes a PowerShell script in memory. - PowerShell script extracts archive contents and launches a Python-based C2 loader. - Loader selects from three hard-coded C2 domains randomly, sleeps 90-120 seconds between check-ins, decrypts and executes server responses. - Seven identified modules: System Profiler (C# DLL, system recon), Persistence Module (native DLL, randomly named scheduled task running at login and daily at 10 a.m.), PhishLocker (DLL serving fake Windows lock screen to capture login password), TrafficRedirector (backconnect/reverse proxy), Interactive Shell (RAT executing PowerShell commands), StreamMaster (VNC module for desktop streaming and remote control), Status Checker (Python script reporting active modules). - Suspected to serve a ransomware group or initial access broker.
1. Block or alert on execution of commands pasted into the Windows Run dialog originating from browser interactions (ClickFix/FakeCaptcha awareness). 2. Educate users to never paste clipboard content into Run dialogs or terminal windows when prompted by websites. 3. Monitor and restrict WebDAV connections (especially outbound to unknown remote shares) and rundll32.exe loading from network paths. 4. Block or monitor conhost.exe --headless usage and cmd.exe spawned with obfuscated environment variables. 5. Enable and monitor Event Tracing for Windows (ETW) and alert on attempts to bypass it via hardware breakpoints. 6. Block access to known compromised domains listed as IOCs at the network/DNS level. 7. Block or restrict access to cdn.jsdelivr[.]net for PowerShell/script execution contexts. 8. Monitor for MSI installations originating from Azure Blob Storage or other cloud file-sharing endpoints not on an approved list. 9. Restrict or monitor Microsoft Teams external message requests, especially from onmicrosoft.com domains impersonating IT staff. 10. Implement application allowlisting to prevent unauthorized Python, MSI, and PowerShell-based loaders from executing. 11. Monitor for creation of suspicious scheduled tasks with random names or tasks running at login and daily at 10 a.m. 12. Deploy behavioral detection for fake Windows lock screen overlays (PhishLocker) and credential phishing at the OS level. 13. Monitor for backconnect/reverse proxy activity (TrafficRedirector) from endpoints. 14. Apply application-bound encryption (ABE) protections in browsers and monitor for bypass attempts. 15. Alert on Heaven's Gate and WoW64 transition abuse patterns in process telemetry. 16. Hunt for reflective DLL loading patterns consistent with Amatera Stealer's shellcode loader. 17. Block outbound connections to the three hard-coded C2 domains used by SynkLoader (obtain from threat intelligence feeds or sandbox analysis).
abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, www.caesarjaco.co[.]id, skybap[.]shop, https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi, cdn.jsdelivr[.]net (abused for malicious PowerShell hosting), WordlistLoader (malware family), SynkLoader (malware family), Amatera Stealer / ACR Stealer / AcridRain Stealer (malware family), Amatera Stealer version 4.3.3-alpha1, PhishLocker DLL module, StreamMaster VNC module, TrafficRedirector backconnect module, MSI installer posing as PowerShell Cleaner, WebDAV share loaded via rundll32.exe, conhost.exe --headless (used for stealth execution), Scheduled task created for persistence (randomly named, daily 10 a.m. trigger)
