Full research report

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

WordlistLoader's primary innovation is encoding shellcode as sequences of plain English words drawn from a fixed 256-word vocabulary, a technique designed to defeat both signature-based and entropy-based detection by presenting payload bytes as human-readable text. Combined with a hardware-breakpoint-driven ETW bypass that silences kernel-level telemetry, it delivers Amatera 4.3.3-alpha1, which introduces direct-kernel-call trampolines (Heaven's Gate) and a Chromium application-bound encryption bypass via thread-pool hijacking—capabilities previously associated with more sophisticated commodity stealers such as Lumma. SynkLoader is architecturally distinct: a multi-language modular kit (Python, PowerShell, C#, C++) assessed as an initial-access broker tool, whose PhishLocker component harvests Windows credentials through a convincing full-screen fake lock screen without exploiting any software vulnerability. Neither malware family is associated with CVEs; the entire attack surface in both chains is user behaviour under social engineering pressure, meaning clipboard-execution awareness, Teams external-messaging controls, and application-execution policy (blocking unsigned DLLs from network paths) are the highest-priority defensive levers. The Amatera lineage's rapid capability growth between versions 4.0.2 and 4.3.3—including tripled wallet targets, doubled browser coverage, and improved kernel-evasion techniques—indicates an active development operation iterating quickly against browser-vendor and endpoint-security countermeasures.

What happened

Gen Digital published research on 19 August 2026 identifying WordlistLoader, a new intermediate-stage loader delivered via ClearFake campaigns using the ClickFix social engineering technique; it encodes shellcode as sequences of plain English words and ultimately executes Amatera Stealer 4.3.3-alpha1. Separately, Expel researchers identified SynkLoader, a modular malware family delivered via Microsoft Teams phishing impersonating IT help desk personnel, first compiled around 28 July 2026. Both malware families are assessed as likely serving ransomware initial-access brokers. Amatera is the rebranded and actively developed continuation of ACR Stealer (AcridRain), a C++ information stealer previously sold as malware-as-a-service on Russian-speaking forums by the actor SheldIO.

Affected scope

Windows users on 32-bit and 64-bit systems targeted through compromised websites serving ClickFix prompts; corporate employees receiving unsolicited Microsoft Teams messages impersonating IT support; users of Chromium-based browsers (Chrome, Edge, Brave) at risk from Amatera's application-bound encryption bypass; holders of cryptocurrency assets across 137 desktop wallet types and 165 browser extensions targeted by Amatera's expanded credential harvesting.

Technical assessment

WordlistLoader encodes shellcode bytes as entries from a 256-word English vocabulary, evading entropy- and signature-based detection by presenting as plain text. It bypasses Event Tracing for Windows by setting a hardware breakpoint on ntdll's trace-event function and redirecting execution to a no-op stub via a vectored exception handler. Payload delivery uses WebDAV shares mounted by pushd and executed through rundll32.exe, with conhost --headless suppressing visible console windows. EtherHiding stores the first-stage JavaScript in a blockchain smart contract, allowing URL rotation without modifying compromised websites. Amatera 4.3.3-alpha1 adds Heaven's Gate indirect syscall trampolines to bypass user-mode hooks and a novel Chromium application-bound encryption bypass via thread-pool (PoolParty variant 7) hijacking. SynkLoader's PhishLocker overlays a convincing fake Windows 11 lock screen to harvest credentials without exploiting any software vulnerability.

Recommended defensive actions

  1. Block or alert on rundll32.exe loading DLLs from WebDAV UNC paths, especially where preceded by pushd commands or conhost --headless invocations in the process tree.
  2. Audit Microsoft Teams external-access policies to restrict or disable chat from unmanaged external tenants, reducing the IT-impersonation phishing surface.
  3. Monitor for randomly named scheduled tasks configured to trigger at logon and at a fixed daily time, a confirmed SynkLoader persistence indicator.
  4. Deploy endpoint detection rules for hardware-breakpoint manipulation of ntdll (NtTraceEvent) and VEH-handler registration from unsigned modules, indicating WordlistLoader's ETW bypass.
  5. Hunt for out-of-process memory writes to Chromium browser regions and NtSetIoCompletion calls from unexpected parent processes, indicating Amatera's application-bound encryption bypass via thread-pool hijacking.

Uncertainties and evidence gaps

  • No confirmed attribution of WordlistLoader or SynkLoader to a specific named threat actor or group beyond Amatera's MaaS context under SheldIO; whether the two loaders share operators is unconfirmed.
  • Victim count and geographic spread of active SynkLoader deployments are not publicly quantified; the 28 July 2026 first-compilation date is approximate.
  • The number of compromised websites serving ClearFake ClickFix prompts beyond the six listed examples is unknown.
  • Whether Amatera's source-code sale in 2024 has produced additional variants under different operators is unresolved.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser-initiated execution required in both chains: victim must paste and run a clipboard command via the Windows Run dialog (WordlistLoader/ClickFix) or manually install a malicious MSI downloaded from Azure (SynkLoader); no unauthenticated remote code execution pathway exists.
ComponentWindows user session (Run dialog, WebDAV client, rundll32.exe) for WordlistLoader; Microsoft Teams messaging client and Windows scheduled-task engine for SynkLoader.
MechanismClickFix social engineering places a malicious command in the victim's clipboard via a fake CAPTCHA interaction on a compromised website; the command mounts a remote WebDAV share and invokes rundll32 to load WordlistLoader. EtherHiding retrieves the injection JavaScript from a blockchain-stored smart contract, decoupling URL rotation from site re-compromise. SynkLoader is delivered as a signed-looking MSI from Azure blob storage after Teams impersonation of IT personnel.
ImpactCredential theft from browsers, cryptocurrency wallets, and the Windows login session; persistent remote access and Active Directory reconnaissance enabling lateral movement and ransomware staging.
DetectionUnsigned DLL execution via rundll32 from WebDAV UNC paths; conhost --headless spawning cmd.exe; randomly named scheduled tasks at logon; full-screen borderless windows with no corresponding taskbar entry (Alt+Tab reveals underlying desktop); out-of-process thread-pool writes to browser processes.
MitigationRestrict rundll32 and regsvr32 from loading DLLs from network (UNC/WebDAV) paths via Windows Defender Application Control or AppLocker; disable Microsoft Teams external-tenant messaging where not operationally required; apply browser isolation for untrusted web sessions; update EDR rules for Heaven's Gate indirect-syscall trampoline patterns and ETW hardware-breakpoint bypass.
Exploitation status

No CVEs associated with this story; both WordlistLoader and SynkLoader are confirmed active in campaigns as of August 2026, relying entirely on social engineering (ClickFix clipboard commands and Microsoft Teams IT-impersonation) rather than software vulnerability exploitation.

Research process

Investigation began with the THN article describing two newly identified malware families—WordlistLoader and SynkLoader—attributed to Gen Digital and Expel research respectively. The Gen Digital primary blog post provided granular technical detail confirming the novel wordlist encoding scheme, ETW bypass, and Amatera 4.3.3-alpha1 capabilities; BleepingComputer independently verified SynkLoader's modular design from a separate research team. Amatera's lineage and SheldIO attribution were corroborated through eSentire's prior version analysis and Malpedia's ACR Stealer reference entry. No CVEs are associated with this story; exploitation relies entirely on social engineering rather than software vulnerabilities, which is the key defensive framing.

  1. What does the primary THN article report about WordlistLoader and SynkLoader, and which primary research sources does it cite?
    Fetched the THN article to extract technical claims and identify underlying research attribution.
    thehackernews.com ↗

    THN summarises Gen Digital research on WordlistLoader (ClickFix/EtherHiding delivery, wordlist shellcode, WebDAV rundll32 chain) and cites Expel for SynkLoader; Amatera is linked to ACR Stealer and the SheldIO actor.

    why Established the event scope and identified Gen Digital and Expel as independent primary sources requiring direct verification.

  2. Is there broader independent coverage of this campaign and what is the publication timeline?
    Searched for WordlistLoader, Amatera, ClickFix, and ClearFake coverage in 2026.

    Multiple independent outlets (GBHackers, CyberPress, BrinzTech, CybersecurityNews) covered the story citing Gen Digital's 19 August 2026 publication; RST Cloud flagged the campaign as high-completeness around the same date.

    why Confirmed widespread independent secondary coverage and established the publication date, supporting the campaign's authenticity.

  3. What technical depth does Gen Digital's own blog provide, and does it confirm or extend the THN summary?
    Fetched the Gen Digital primary research post directly.
    gendigital.com ↗

    Confirmed wordlist encoding scheme with a 256-word vocabulary, hardware-breakpoint ETW bypass, Heaven's Gate x64 indirect syscall trampolines in Amatera 4.3.3-alpha1, Chromium ABE bypass via PoolParty thread-pool hijacking, 14 C2 domains, and 21 file hashes across both malware families.

    why Primary source substantially elevated confidence in the technical assessment and provided artefacts (hashes, C2 domains) for defender use.

  4. Does independent reporting corroborate SynkLoader's capabilities and delivery method?
    Searched for SynkLoader and Microsoft Teams phishing 2026, then fetched the BleepingComputer article.
    bleepingcomputer.com ↗

    Expel researchers confirmed seven SynkLoader modules, Azure blob storage MSI delivery, approximately 28 July 2026 compilation date, per-infection unique module hashes, and ransomware group access-brokering assessment.

    why Independent research team on a separate outlet corroborated SynkLoader's existence and capabilities, satisfying the two-source requirement for this threat family.

  5. What is Amatera's malware lineage, actor attribution, and are any CVEs associated with the campaign?
    Fetched the Malpedia ACR Stealer entry and the eSentire Amatera 4.0.2 Beta analysis.
    malpedia.caad.fkie.fraunhofer.de ↗

    Malpedia confirms SheldIO attribution on Russian-speaking forums, GrMsk Stealer lineage, and Amatera as the rebranded successor; eSentire documents prior capability expansion (65 browsers, 137 wallets, RecycledGate syscall obfuscation, ECDH C2). No CVEs are associated with the current campaign.

    why Established the malware family's history and confirmed that defensive posture must focus on social-engineering controls and application-execution policies rather than vulnerability patching.

Named in this story
ActorsSheldIO
MalwareWordlistLoaderAmatera StealerACR StealerAcridRain StealerSynkLoaderPhishLockerGrMsk Stealer
TargetsWindows users visiting compromised websites (ClickFix/ClearFake lures)Corporate employees targeted via Microsoft Teams IT-impersonation phishingChromium-based browser users (Chrome, Edge, Brave)Cryptocurrency wallet holders

Research coverage

All 67 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 67 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok8 records Primary evidence1 matched items Published the source report used to frame and date the event.
BleepingComputernews ok9 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1675 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5332 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Analysis & research4
Gen Digital: WordlistLoader Delivering Amatera via ClearFake Campaigns gendigital.com ↗

Primary technical analysis detailing wordlist shellcode encoding, ETW hardware-breakpoint bypass, Heaven's Gate trampolines, and Amatera 4.3.3-alpha1 Chromium ABE bypass.

BleepingComputer: New SynkLoader malware pushed in Microsoft Teams phishing campaign bleepingcomputer.com ↗

Independent Expel research confirming SynkLoader's seven modules, Azure-hosted MSI delivery, July 2026 compilation date, and ransomware initial-access context.

eSentire: Amatera Stealer 4.0.2 Beta — What's New in This Variant esentire.com ↗

Prior version analysis establishing Amatera's lineage, RecycledGate syscall obfuscation, ECDH C2 encryption, and expanded browser/wallet targeting.

Malpedia: ACR Stealer (win.acr_stealer) malpedia.caad.fkie.fraunhofer.de ↗

Reference entry confirming SheldIO attribution on Russian-speaking forums, GrMsk Stealer lineage, and Amatera as the rebranded successor family.