Cybersecurity researchers have identified two new malware families — WordlistLoader and SynkLoader — that are being used to deliver next-stage payloads and sell initial access to ransomware groups, according to a report from The Hacker News.
WordlistLoader: ClickFix Delivers Amatera
WordlistLoader leverages the ClickFix social engineering technique to trick victims into executing malicious commands. ClickFix is a well-documented lure that displays fake error messages or CAPTCHA prompts, instructing users to copy and paste a PowerShell or command-line instruction that silently installs malware.
In this campaign, WordlistLoader is used as a dropper for Amatera — a next-stage payload whose capabilities position it as a modular implant suitable for ransomware operators seeking initial access. The use of ClickFix suggests the threat actors are targeting less technically sophisticated users who may not recognize the social engineering cue.
ClickFix Attack Flow
- Victim visits a compromised or malicious website displaying a fake error
- Page instructs user to "fix" the issue by running a provided PowerShell command
- Command downloads and executes WordlistLoader
- WordlistLoader drops the Amatera payload and establishes persistence
- Access is sold to ransomware affiliates or used for further intrusion
SynkLoader: Windows Password Phishing
SynkLoader takes a more direct approach, using phishing campaigns to harvest Windows credentials from victims. The loader is designed to extract saved passwords from browsers, Windows Credential Manager, and other local credential stores — packaging the stolen data for exfiltration.
Like WordlistLoader, SynkLoader's end-game appears to be access brokering: stolen credentials are packaged and sold to ransomware groups or other threat actors who use them to gain an initial foothold in corporate environments.
SynkLoader Capabilities (Observed)
- Credential harvesting from browsers (Chrome, Edge, Firefox)
- Windows Credential Manager extraction
- Keylogging for active session capture
- C2 communication for data exfiltration
- Persistence via scheduled tasks or registry run keys
Ransomware Access Broker Ecosystem
Both loaders fit the profile of Initial Access Brokers (IABs) — a thriving segment of the cybercriminal economy where threat actors specialize in gaining and selling access rather than directly executing ransomware. This division of labor lowers the barrier for ransomware deployment and increases the overall volume of attacks.
The emergence of two distinct loaders in a short period suggests an active and competitive IAB market, with developers refining techniques to evade endpoint detection.
Detection and Defense
For organizations:
- Deploy endpoint detection and response (EDR) tools with behavioral monitoring capable of detecting PowerShell execution chains
- Enable Windows Defender Credential Guard to protect credential stores
- Block execution of scripts from user-writable directories via AppLocker or Windows Defender Application Control (WDAC)
- Train users to recognize ClickFix-style social engineering lures
- Monitor for unexpected credential access patterns in Windows Event Logs (Event IDs 4624, 4648, 4776)
Indicators to monitor:
- Unexpected PowerShell or mshta.exe spawned from browser processes
- Outbound connections from cmd.exe or wscript.exe
- Access to browser profile directories (
%APPDATA%\Local\Google\Chrome\User Data\Default\Login Data) by non-browser processes