Researchers from Gen Digital and Expel independently identified two previously unknown malware loaders — WordlistLoader and SynkLoader — each using a separate delivery vector to deploy their final payloads on Windows systems. WordlistLoader serves as an intermediate stage in an infection chain delivering the Amatera stealer (also known as ACR Stealer / AcridRain Stealer) via ClearFake campaigns, while SynkLoader is spread through social engineering on Microsoft Teams and provides its operator with a modular remote access toolkit. Organizations using Windows infrastructure are advised to review the indicators of compromise and delivery techniques described here to update their detection rules.
WordlistLoader: from ClickFix to the Amatera stealer
According to Gen Digital, WordlistLoader is delivered via ClearFake campaigns that use the ClickFix (FakeCaptcha) technique. A victim visits a compromised legitimate website where they are prompted to complete a CAPTCHA check. When they click the “I’m not a robot” checkbox, a malicious command is copied to the clipboard, and the user is instructed to paste it into the Windows Run dialog and execute it. The result is the download of WordlistLoader and subsequent execution of Amatera.
Malicious ClickFix prompts are injected into legitimate sites via JavaScript encoded in Base64. This code queries a smart contract on a blockchain to obtain the next stage — a technique known as EtherHiding. Among the compromised sites serving ClickFix prompts, the researchers listed:
- abogadosrosarinos[.]com
- aptisweb[.]com
- avene-hebergement[.]com
- https-xhamster[.]com
- www.caesarjaco.co[.]id
- skybap[.]shop
As Expel specialists noted back in January, updated ClearFake campaigns began using cdn.jsdelivr[.]net to host malicious PowerShell scripts. Although jsDelivr promptly removes malicious repositories, the EtherHiding mechanism allows operators to quickly replace blocked URLs with new working addresses.
Technical execution chain
The ClickFix command uses conhost.exe to launch a hidden cmd.exe process, mounts a remote WebDAV resource via pushd, and starts the loader via rundll32.exe. Microsoft independently documented a similar chain in the context of ACR Stealer, highlighting three command variants:
- Direct invocation of
rundll32 - Mounting a WebDAV resource via
pushdfollowed by arundll32.execall - Hidden, obfuscated execution of
pushdviaconhost.exe --headlesswith environment variable obfuscation — this variant matches the WordlistLoader chain
According to Microsoft, the most advanced variant suppresses visible console windows and uses delayed environment variable expansion to hide key execution components — pushd, rundll32, and the remote host name. Microsoft observed Python-based loaders in this chain from late April through mid-June 2026; in Gen Digital’s assessment, these were replaced with WordlistLoader in later campaigns, although this conclusion is based on correlation of the two vendors’ data and has not been directly confirmed by Microsoft.
WordlistLoader characteristics
The primary task of WordlistLoader is to reconstruct shellcode that serves as the entry point for subsequent stages. The shellcode is stored in encoded form as a sequence of ordinary English words, with each word representing one byte — hence the loader’s name. Gen Digital’s researchers also found a variant in which the wordlist is replaced with an array of 16-byte chunks encoded in UUID format.
To evade telemetry, WordlistLoader uses a hardware-breakpoint-based technique to bypass Event Tracing for Windows (ETW). The reconstructed shellcode leverages a reflective loader to unpack and execute Amatera in memory. The same reflective loader was observed by eSentire in late April 2026 in a different ClickFix campaign delivering Amatera version 4.3.3-alpha1.
According to Gen Digital, the latest version of Amatera includes updated static obfuscation, strengthened system function invocation through a WoW64 transition, dynamically generated x64 indirect syscall trampolines via Heaven’s Gate, as well as a reworked bypass of Application-Bound Encryption, presumably inspired by the Remus stealer.
SynkLoader: modular toolkit delivered via Microsoft Teams phishing
The second loader, SynkLoader, was discovered by Expel specialists in mid-August 2025. Its delivery vector is fundamentally different from WordlistLoader’s: the attacker contacted the victim via Microsoft Teams using an account in the format <username>@<company>.onmicrosoft.com and posed as an IT Service Desk employee.
The victim was persuaded to download and install an MSI file from Azure Blob Storage (https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi). Hosting on Microsoft infrastructure gave the file an appearance of legitimacy. The installer masqueraded as a “PowerShell Cleaner” utility and, when launched, extracted a ZIP archive and a PowerShell script that was executed in memory. The script unpacked the archive contents and launched a Python loader, which selected one of three hard-coded C2 domains and polled the server at random intervals, pausing 90–120 seconds between requests.
Modular architecture
Expel identified at least seven SynkLoader modules:
- System Profiler — a C# DLL for collecting system information
- Persistence Module — a native DLL that creates a scheduled task with a random name to launch SynkLoader at user logon and daily at 10:00
- PhishLocker — a DLL that displays a fake Windows lock screen to capture the password
- TrafficRedirector — a reverse proxy for accessing local network services or routing traffic through the compromised machine
- Interactive Shell — a RAT module for executing PowerShell commands
- StreamMaster — a VNC module for desktop streaming and remote mouse and keyboard control
- Status Checker — a Python script for reporting the status of running modules
The combination of capabilities — from credential theft and reverse proxying to full remote control — points to tooling geared toward deep persistence in the target environment. Expel suggests that the operator may be linked to a ransomware group or an initial access broker, although no specific attribution has been confirmed.
Impact assessment and context
Both threats target Windows systems but differ in their distribution model and intended audience. WordlistLoader, delivered via ClearFake, is geared toward mass infection — any visitor to a compromised site can become a victim. SynkLoader, by contrast, uses targeted phishing via Microsoft Teams, which is more typical of attacks on corporate environments. Abuse of legitimate infrastructure is particularly dangerous: jsDelivr CDN, Azure Blob Storage, and blockchain contracts all make network-level blocking more difficult.
The overlap between WordlistLoader techniques and the ACR Stealer chains independently documented by Microsoft confirms that these delivery methods are actively used by multiple groups or constitute a service available to different operators.
Mitigation recommendations
- Restrict the use of
rundll32.exeto load DLLs from remote WebDAV resources via AppLocker or WDAC policies - Monitor execution of
conhost.exe --headlessandconhost → cmd → rundll32chains as indicators of suspicious activity - Configure detection rules for access to WebDAV resources via
pushdwithin user sessions - In Microsoft Teams, limit inbound messages from external domains, especially from *.onmicrosoft.com addresses not owned by the organization
- Block the download and execution of MSI files from Azure Blob Storage for non-privileged users
- Add the listed domains (abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, skybap[.]shop) and the MSI installer URL to blocklists
- Review ETW logs for anomalies associated with bypassing tracing via hardware breakpoints
The emergence of WordlistLoader and SynkLoader illustrates a persistent trend toward multi-stage delivery chains with intermediate loaders that abuse legitimate infrastructure. Priority actions for security teams include configuring detection of conhost → cmd → rundll32 chains involving WebDAV downloads, limiting external communication in Microsoft Teams, and reviewing network logs for connections to the listed indicators of compromise.
