Full Report
Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha)
Analysis Summary
# Tool/Technique: WordlistLoader & SynkLoader
## Overview
**WordlistLoader** and **SynkLoader** are newly identified malware families acting as delivery mechanisms (loaders) for next-stage payloads. WordlistLoader is primarily associated with **ClearFake** campaigns using the **ClickFix** technique to deliver the **Amatera Stealer** (also known as ACR or AcridRain Stealer). These loaders are likely used by Initial Access Brokers (IABs) to sell access to ransomware groups.
## Technical Details
- **Type:** Malware family (Loaders)
- **Platform:** Windows
- **Capabilities:** Payload delivery, shellcode reconstruction, credential theft (via next-stage), Living-off-the-Land (LotL) execution.
- **First Seen:** April – June 2026 (Active observations)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (ClearFake/ClickFix)
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1218.011 - System Binary Proxy Execution: Rundll32]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information] (EtherHiding, Base64)
- [T1134.004 - Access Token Manipulation: Parent PID Spoofing] (conhost --headless)
- [T1027.009 - Obfuscated Files or Information: Embedded Payloads] (Steganography in JPEGs)
- **[TA0011 - Command and Control]**
- [T1568.002 - Dynamic Resolution: Domain Generation Algorithms] (EtherHiding via Smart Contracts)
- [T1105 - Ingress Tool Transfer]
## Functionality
### Core Capabilities
- **ClickFix (FakeCaptcha) Flow:** Deceives users into copying a malicious command to their clipboard and executing it via the Windows "Run" dialog.
- **EtherHiding:** Uses smart contracts on the blockchain to store and retrieve malicious JavaScript, allowing for easy updates to burnt C2 URLs.
- **WebDAV Mounting:** Maps remote shares using `pushd` to execute payloads without saving them directly to the local disk in a traditional manner.
### Advanced Features
- **Headless Execution:** Utilizes `conhost.exe --headless` to suppress console windows, making the infection invisible to the user.
- **Delayed Variable Expansion:** Employs environment variable obfuscation to hide critical strings like `rundll32` and `pushd`.
- **Steganography:** Extracts the final stealer payload from JPEG images hosted on legitimate services to bypass file-based scanning.
## Indicators of Compromise
- **Network Indicators:**
- `cdn.jsdelivr[.]net` (Abused CDN)
- `abogadosrosarinos[.]com`
- `aptisweb[.]com`
- `avene-hebergement[.]com`
- `https-xhamster[.]com`
- `www.caesarjaco.co[.]id`
- `skybap[.]shop`
- **Behavioral Indicators:**
- `cmd.exe` spawning `rundll32.exe` from a `pushd` mapped drive.
- Unexpected use of `conhost.exe` with the `--headless` flag.
- PowerShell scripts fetching data from blockchain-related domains or smart contracts.
## Associated Threat Actors
- **ClearFake Operators** (Campaign name)
- **Initial Access Brokers (IABs)** (Likely targeting ransomware affiliates)
## Detection Methods
- **Behavioral Detection:** Monitor for the sequence of `cmd.exe` -> `pushd` -> `rundll32.exe` targeting remote WebDAV paths.
- **Clipboard Monitoring:** (Advanced) Detect scripts or commands that programmatically interact with the clipboard to suggest Windows Run commands.
- **Network Monitoring:** Alert on traffic to known blockchain smart contract APIs originating from browser processes or system utilities.
## Mitigation Strategies
- **User Training:** Educate users on the "ClickFix" social engineering tactic; emphasize that legitimate CAPTCHAs never require running commands in the Windows Run dialog.
- **Execution Prevention:** Restrict the use of `rundll32.exe` and `cmd.exe` from spawning processes that access external WebDAV shares (via GPO or EDR policies).
- **CDN Filtering:** Inspect or limit access to public CDNs (like jsDelivr) if they are not required for business operations, or use SRI (Subresource Integrity) for known scripts.
## Related Tools/Techniques
- **Amatera Stealer (ACR/AcridRain):** The primary payload delivered.
- **ClearFake:** The broader distribution framework.
- **EtherHiding:** The technique of hiding C2/scripts in blockchain contracts.