WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials

Two New Malware Loaders Flagged by Researchers

Cybersecurity researchers at Gen Digital have identified two new malware families operating in parallel: WordlistLoader and SynkLoader. Both are being used to deliver next-stage payloads and are assessed with high confidence to be selling initial access to ransomware affiliate groups — a business model that has fueled the ransomware-as-a-service (RaaS) ecosystem for years.

WordlistLoader: ClickFix Delivers Amatera Stealer

WordlistLoader takes its name from a social engineering lure: victims are tricked into running a script under the pretense of accessing a wordlist or tool commonly used by security researchers and gamers. The delivery mechanism abuses ClickFix — a technique that has grown rapidly in 2025–2026 where a fake browser error or CAPTCHA page instructs the user to paste a command into PowerShell or the Windows Run dialog.

The ClickFix Delivery Chain

1. Victim lands on a compromised or attacker-controlled website
2. Site displays a fake browser error / CAPTCHA requiring "verification"
3. User is instructed to copy and paste a command into PowerShell
4. PowerShell executes a script that downloads WordlistLoader
5. WordlistLoader fetches and executes Amatera Stealer (ACR Stealer)
6. Stealer harvests credentials, cookies, crypto wallets, and browser data
7. Data exfiltrated to attacker C2

Amatera Stealer (ACR Stealer)

WordlistLoader's primary payload is Amatera Stealer, also tracked as ACR Stealer — a commodity infostealer sold on underground forums. Amatera targets:

• Browser credentials and saved passwords (Chrome, Firefox, Edge)
• Browser session cookies (enabling session hijacking without passwords)
• Cryptocurrency wallet files and extensions
• Discord tokens
• Files matching patterns of interest (documents, key files)
• Clipboard content

The stealer compresses harvested data and exfiltrates it to attacker-controlled infrastructure, typically via Telegram bots or dedicated C2 panels.

SynkLoader: Phishing Windows Credentials

SynkLoader operates differently. Rather than deploying a traditional infostealer payload, SynkLoader's primary function is credential phishing at the OS level — harvesting Windows account credentials directly.

How SynkLoader Works

SynkLoader presents victims with a fake Windows authentication dialog that closely mimics the legitimate Windows Security prompt. When the user enters their credentials — either because they believe a system process requires it or because they are confused by the spoofed UI — the credentials are captured and transmitted to the attacker.

This technique is effective because:

• Windows authentication dialogs are familiar and trusted by most users
• Modern endpoint security tools may not flag a crafted WinForms dialog as malicious
• Credentials harvested this way are valid Windows credentials — not just browser passwords
• Domain-joined machines may expose Active Directory credentials, enabling lateral movement

Access Brokering

Like WordlistLoader, SynkLoader's ultimate objective appears to be access brokering: selling the harvested credentials or established footholds to ransomware affiliates who then conduct the encryption and extortion phase. This division of labor — initial access brokers (IABs) feeding the RaaS supply chain — is now the dominant model in ransomware operations.

Threat Landscape Context

Both loaders represent the continued industrialization of cybercrime. Key trends they illustrate:

Detection Guidance

WordlistLoader / ClickFix Indicators

Watch for PowerShell spawned from browser processes or Run dialog:

# Suspicious pattern: browser spawning PowerShell
# Parent: chrome.exe, msedge.exe, firefox.exe
# Child: powershell.exe -WindowStyle Hidden -EncodedCommand ...

SIEM rule (Splunk):

index=endpoint sourcetype=sysmon EventCode=1
| where parent_process_name IN ("chrome.exe","msedge.exe","firefox.exe","iexplore.exe")
  AND process_name="powershell.exe"
| stats count by host, user, parent_process_name, process_command_line

SynkLoader / Fake Windows Auth Dialog

Monitor for suspicious processes spawning credential-prompt UI components:

index=endpoint sourcetype=sysmon EventCode=1
| where process_name NOT IN ("lsass.exe","svchost.exe","explorer.exe","consent.exe")
  AND (process_command_line LIKE "%CredentialPicker%"
    OR process_command_line LIKE "%WindowsSecurity%"
    OR process_command_line LIKE "%credui%")

Network Indicators

Both families use C2 infrastructure for payload delivery and data exfiltration. Block outbound connections from user workstations to:

• Telegram API endpoints (used for C2 via Telegram bots)
• Newly registered domains (< 30 days) matching wordlist/tool themes
• Pastebin and similar paste services (used for hosted payloads)

Mitigation Recommendations

1. User awareness training — Specifically train users to recognize ClickFix lures; no legitimate website will ever ask you to paste a command into PowerShell
2. PowerShell execution policy — Restrict to signed scripts in enterprise environments; log all PowerShell execution with Script Block Logging enabled
3. Application control — Use Windows Defender Application Control (WDAC) or AppLocker to prevent unsigned executables
4. Credential Guard — Enable Windows Credential Guard on domain-joined systems to protect Active Directory credentials from harvesting
5. MFA everywhere — Even if Windows credentials are stolen, MFA on VPN, email, and cloud services limits the blast radius
6. EDR/AV with behavioral detection — Signature-based detection will lag on new malware families; behavioral rules catch the execution patterns

References

• The Hacker News — WordlistLoader and SynkLoader
• Gen Digital Threat Research
• MITRE ATT&CK — ClickFix (T1204.002)
• MITRE ATT&CK — Credentials from Password Stores (T1555)