Security researchers have uncovered a new malware campaign targeting Windows users that encodes malicious payloads within plain English words. The campaign, leveraging a loader known as WordlistLoader, delivers the Amatera Stealer — a tool designed to extract sensitive information from compromised systems. The key to this attack is making malware appear harmless by hiding its code in everyday language.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
Attackers are distributing this threat via a long-standing infrastructure called ClearFake. Legitimate websites are compromised and overlaid with fake CAPTCHA prompts. When visitors click through, they are tricked into copying a command to their clipboard and executing it via the Windows Run dialog. This approach depends on social engineering rather than exploiting software vulnerabilities.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
The Mechanics of WordlistLoader
WordlistLoader’s stealth comes from its ability to store the next-stage shellcode as a sequence of English words. Each word in the sequence corresponds to a byte in a custom list of 256 unique words. At runtime, the loader converts each word back into its respective byte, rebuilding the malicious code in memory. This method complicates detection because the payload looks like normal text until executed.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
There’s also a variant of WordlistLoader that replaces English words with Universally Unique Identifiers (UUIDs). In that version, each UUID encodes a 16-byte chunk of code. Though the encoding changes, the function—the builder and executor of the shellcode—remains the same.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
Amatera, Fake CAPTCHAs & Evasion Tactics
Once a user completes the fake CAPTCHA, they are directed to execute a hidden command, which uses WebDAV to fetch a malicious DLL. The DLL is launched using rundll32.exe, a trusted Windows component. These tactics bypass the need for exploits by relying on built-in tools and user compliance.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
Amatera (also known as ACR Stealer) is continually evolving. Newer versions improve obfuscation, evade hooking mechanisms, and even target browser encryption keys—especially those protected by chromium’s application-bound encryption.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
As part of its evasion strategy, WordlistLoader checks for existing instances of itself, restores tampered system module functions, and interferes with event logging on Windows. These features are designed to hinder analysis and detection.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
Indicators & Mitigation Advice
Known indicators include several compromised websites serving ClearFake overlays (like abogadosrosarinos[.]com, aptisweb[.]com, among others), domains tied to WebDAV infrastructure used in the attack, and sample DLL filenames like gmwmvymdzgqgptwvbslq.dll. There are also SHA-256 hashes linked both to the WordlistLoader and Amatera variants.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
Users should be wary of any site or CAPTCHA prompt that asks them to open Run, Command Prompt, PowerShell, or paste commands into such – these are red flags. From a defensive standpoint, monitoring for rundll32 activity, suspicious WebDAV connections, and demanding social engineering-based instructions can help. Awareness remains the strongest line of defense.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
This attack chain highlights a trend where malware operators increasingly rely on deception and human error rather than zero-day flaws. Building awareness around unusual clipboard actions or fake prompts is crucial to staying ahead of threats like this.([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-malware-code/))
Analytical View: This campaign shows a striking shift in malware delivery — hiding payloads in plain sight within English text and UUIDs. It’s tougher for signature-based detection and static analysis tools to flag such threats. For defenders, the takeaway is that behavioral cues—unexpected system interactions, clipboard manipulation, rundll32 usage—are becoming more vital. Going forward, investment in tools that inspect live behavior combined with user training against social engineering will be essential to counter this evolving stealer strategy.
