WordlistLoader Drops Amatera Stealer via ClickFix; SynkLoader Phishes Windows

Cybersecurity researchers at Gen Digital have identified two newly tracked malware families—WordlistLoader and SynkLoader—being deployed to harvest Windows credentials and stage next-stage payloads, with access likely offered to ransomware affiliates.

WordlistLoader is being distributed through ClearFake campaigns abusing the ClickFix (FakeCaptcha) social engineering technique. Victims browsing compromised legitimate websites—including abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, and www.caesarjaco.co[.]id—are shown a fake "I'm not a robot" CAPTCHA prompt. Once clicked, a malicious command is silently copied to their clipboard, and the user is instructed to paste it into the Windows Run dialog. The command launches a hidden cmd.exe via conhost, mounts a remote WebDAV share using pushd, and ultimately executes the loader through rundll32.exe, culminating in the deployment of Amatera Stealer (also known as ACR or AcridRain Stealer).

The underlying infrastructure has evolved to combine EtherHiding—storing malicious JavaScript on blockchain smart contracts—with abuse of the legitimate jsDelivr CDN (cdn.jsdelivr[.]net) to stage rogue PowerShell scripts. This pairing enables threat actors to rapidly swap burned URLs and evade takedowns. Researchers have documented three command variants: a direct rundll32 invocation, a pushd-mounted WebDAV share followed by rundll32.exe, and a headless/obfuscated pushd execution that matches the WordlistLoader infection chain observed by Gen Digital researcher Vojtěch Krejsa.

SynkLoader, meanwhile, functions as a dedicated Windows credential phishing tool, capturing user passwords from compromised hosts. Individuals concerned about exposure should immediately run a password checker against known breach corpora and use the email breach checker to evaluate account-level risk. Defenders are urged to monitor for conhost.exe-spawned cmd.exe processes, block outbound WebDAV traffic to untrusted destinations, and review endpoint detections for the listed ClickFix-related IOCs.