A newly discovered pair of malware families—WordlistLoader and SynkLoader—are playing central roles in sophisticated campaigns that steal credentials, deliver malware, and pave the way for ransomware group access. Cyber researchers from Gen Digital and Expel have shed light on each threat’s tactics, infection chain, and evolving features.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
WordlistLoader’s Deep Dive with Amatera via ClickFix
WordlistLoader serves as the malicious middleman in recent attacks pushing the Amatera Stealer payload (also known as ACR or AcridRain Stealer). It piggybacks on ClearFake campaigns using fake CAPTCHA pages—commonly known as ClickFix or FakeCaptcha—to trick victims into executing malicious commands via Windows Run.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
The flow starts when a user clicks an “I’m not a robot” checkbox. A compromised real website, injected with JavaScript hidden in a Base64 blob, triggers the prompt. That blob fetches further JavaScript via a smart contract on the blockchain in a method dubbed EtherHiding.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
The command instructed to the victim involves launching hidden cmd.exe via conhost, mapping a remote WebDAV share using pushd, and running a DLL via rundll32.exe. Attackers have mixed and matched direct or obfuscated command variants to evade detection.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
WordlistLoader’s signature tactic: shellcode stored as English words—each word representing a byte. Some variants replace this with sequences of 16-byte UUID strings. Shellcode includes a reflective loader that unpacks Amatera in memory, side-stepping on-disk detections. The loader also uses hardware breakpoint methods to bypass Event Tracing for Windows.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
The newest Amatera version includes stronger evasion: static obfuscation, hardened syscall invocation via the WoW64 layer, dynamically generated x64 indirect syscall trampolines (using techniques like Heaven’s Gate), and improved bypasses for application-bound encryption inspired by other modern stealers.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
SynkLoader’s Microsoft Teams Lure
Meanwhile SynkLoader has been spotted in Microsoft Teams-based phishing campaigns aimed at harvesting Windows login credentials. The attack begins with what appears to be an email from an IT service desk using a Microsoft 365 corporate address.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
The recipient is coerced into installing an MSI package hosted on Microsoft Azure that masquerades as a legitimate PowerShell cleaner. Once run, it extracts both a ZIP and a PowerShell script. That script is executed in-memory to unpack additional files and launch a Python-based loader that periodically checks in with one of several hardcoded command-and-control servers.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
SynkLoader comes with multiple modules, each tailored to a specific goal: gathering system info; ensuring startup persistence; mimicking Windows lock screens to harvest passwords (PhishLocker); redirecting traffic or enabling backconnect; exposing an interactive shell; using VNC for remote control of desktop; plus status reports on module activity.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
At this time, it’s not fully clear whether these campaigns are serving ransomware groups directly, or working as brokers offering initial access for hire. But the overlapping tactics—evasion, credential theft, modular payloads—suggest they’re part of larger intrusion ecosystems.([thehackernews.com](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html))
What to watch: Detection systems need to spot JavaScript tampering, EtherHiding behavior, and the use of legitimate infrastructure like CDNs or Azure endpoints to avoid suspicion. Since WordlistLoader maps out shellcode through human readable wordlists or UUID arrays, signature-based detection alone will struggle.
These malware actors represent well-planned evolution in threat techniques: social engineering (CAPTCHA click scams, Teams phishing), obfuscation, and stealth loaders. Defenders must focus on behavioral detection, securing content pipelines, and suspending trust in unexpected UI prompts. Holding attackers accountable will require improving site hygiene, patching injection vulnerabilities, and educating end users to never paste commands unless they know exactly what they do.
