WordlistLoader and SynkLoader: Two New Windows Malware Loaders Analysed

Overview

Security researchers have published detailed analyses of two distinct Windows malware loaders active in current campaigns: WordlistLoader, which distributes the Amatera credential stealer via the ClickFix lure technique, and SynkLoader, a multi-stage loader that delivers a modular remote access toolkit through Microsoft Teams phishing. Both demonstrate sophisticated evasion capabilities and reflect the continuing evolution of loader-as-a-service tradecraft.

WordlistLoader: ClickFix to Amatera Stealer

Initial Access via ClearFake and ClickFix

The WordlistLoader campaign leverages the ClearFake infrastructure — a threat actor group known for injecting malicious JavaScript into compromised WordPress and other CMS-backed websites. When a victim lands on a compromised page, obfuscated JavaScript (Base64-encoded) executes in the browser and fetches a secondary payload. In a notable operational security move, this payload is hosted on Ethereum smart contract storage using the EtherHiding technique, which uses blockchain immutability to make C2 payload hosting highly resistant to takedown.

The victim is then presented with a ClickFix (also known as FakeCaptcha) prompt — a fake CAPTCHA or browser notification screen that instructs the user to press Win+R and paste a command. This social engineering lure has become a reliable initial access vector because it bypasses browser security by executing code in a native Windows context.

Execution Chain

Once the user pastes and runs the command:

1. A conhost.exe instance spawns a hidden cmd.exe process.
2. A WebDAV share is mapped using pushd, staging the next-stage payload remotely.
3. rundll32.exe loads a DLL from the WebDAV share — this is WordlistLoader.

WordlistLoader Decoding Technique

WordlistLoader gets its name from an unusual shellcode encoding scheme: it stores its payload as a sequence of plain English words, one word per byte. A variant uses UUID-encoded 16-byte chunks to store the payload, making static pattern detection harder. A reflective loader then unpacks and executes the decoded shellcode in memory.

Amatera 4.3.3-alpha1

The final payload is Amatera, also tracked as ACR Stealer or AcridRain Stealer, version 4.3.3-alpha1. This build introduces hardened evasion capabilities:

• ETW bypass via hardware breakpoints — replaces standard Event Tracing for Windows hook addresses with a hardware breakpoint trap, preventing EDR products from capturing telemetry on key API calls.
• Heaven's Gate — uses x64 indirect system call stubs invoked through the WoW64 subsystem transition (wow64cpu.dll), allowing 32-bit code to issue native 64-bit syscalls and bypass user-mode API monitoring.
• Redesigned application-bound encryption bypass — targets Chrome's App-Bound Encryption scheme for cookie and credential extraction.

Indicators of Compromise

SynkLoader: Microsoft Teams Phishing to Modular RAT

Initial Access via Teams Spoofing

SynkLoader campaigns begin with Microsoft Teams messages sent from spoofed Microsoft 365 accounts impersonating an IT Service Desk. The message directs targets to download what appears to be a legitimate IT tool — a "PowerShell Cleaner" utility — hosted on an Azure Blob Storage endpoint, lending the download URL apparent legitimacy through the *.blob.core.windows.net domain.

Execution Chain

1. The victim downloads and runs an MSI installer.
2. The MSI extracts a ZIP archive and a PowerShell script.
3. The PowerShell script executes entirely in memory to avoid leaving artifacts on disk.
4. A Python-based loader is launched, connecting to hardcoded C2 domains at randomized intervals (sleeping 90–120 seconds between check-ins to evade timing-based behavioral detection).
5. The C2 delivers encrypted modular payloads, decrypted in memory.

Seven Identified Modules

The capability set — particularly the combination of PhishLocker for credential harvesting, TrafficRedirector for lateral movement enablement, and StreamMaster for operator situational awareness — is consistent with initial access broker (IAB) or ransomware pre-stage operations rather than commodity crimeware.

Defensive Recommendations

Against WordlistLoader / ClickFix:

• Train users to recognize ClickFix / FakeCaptcha lures and never execute pasted commands from browser prompts.
• Block or audit rundll32.exe loading DLLs from network paths (WebDAV/UNC).
• Deploy script-block logging and constrained language mode for PowerShell.
• Monitor for ETW tampering and unusual WoW64 activity via EDR telemetry.

Against SynkLoader / Teams phishing:

• Enforce external sender indicators on Microsoft Teams messages from non-tenant accounts.
• Restrict MSI execution to signed, approved packages via Windows Defender Application Control (WDAC) or AppLocker.
• Block outbound connections to unexpected Azure Blob Storage hosts from workstations.
• Alert on Python interpreter spawning from user-writable directories.

References

• The Hacker News — WordlistLoader and SynkLoader Analysis