WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups.
Intelligence analysis by Llama
Researchers have identified two new malware families, WordlistLoader and SynkLoader, used to deliver next-stage payloads and sell access to ransomware groups. WordlistLoader is used to deliver Amatera Stealer via ClearFake campaigns, while SynkLoader is distributed via a Microsoft Teams phishing campaign.
Imagine you're browsing the internet and you see a fake CAPTCHA verification check. If you click on it, you might accidentally download a malicious program that can steal your information. This is what's happening with WordlistLoader and SynkLoader, two new malware families that are used to deliver next-stage payloads and sell access to ransomware groups.
Analysis
Malware Families Identified
Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, used to deliver next-stage payloads and sell access to ransomware groups. These malware families are a significant concern for organizations and individuals, as they can be used to steal sensitive information and disrupt operations.
WordlistLoader
WordlistLoader is a malware family used to deliver Amatera Stealer via ClearFake campaigns. ClearFake campaigns are a type of social engineering attack that uses fake CAPTCHA verification checks to dupe victims into running malicious commands. Once the victim clicks on the 'I'm not a robot' checkbox, they are walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it, leading to the download of WordlistLoader that ultimately results in the execution of Amatera.
The ClickFix prompts are displayed on real websites that have been compromised with malicious JavaScript that's injected in the form of a Base64-encoded blob. The blob, for its part, fetches another JavaScript from a smart contract stored on the blockchain, an approach known as EtherHiding, and dynamically executes the retrieved code. Some of the compromised websites serving ClickFix prompts are abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, and www.caesarjaco.co[.]id.
SynkLoader
SynkLoader is a malware family distributed via a Microsoft Teams phishing campaign to siphon a victim's system login credentials by serving a fake lock screen. The activity was detected by Expel in mid-August 2025. The phishing campaign uses a <username>@<company>.onmicrosoft.com email (Microsoft 365's default email domain for companies) to reach out to the target using the name IT Service Desk (<Fake Name>). The IT service desk convinces the user to download and install the malicious software, which ultimately leads to the execution of SynkLoader.
Implications
The discovery of these malware families highlights the evolving tactics of cybercriminals, who are increasingly using sophisticated techniques to deliver payloads and steal sensitive information. Organizations and individuals must be vigilant and take steps to protect themselves from these types of attacks. This includes implementing robust security measures, such as firewalls and antivirus software, as well as educating users on how to identify and avoid phishing campaigns.
Key points
- Two new malware families, WordlistLoader and SynkLoader, have been identified as used to deliver next-stage payloads and sell access to ransomware groups.
- WordlistLoader is used to deliver Amatera Stealer via ClearFake campaigns.
- SynkLoader is distributed via a Microsoft Teams phishing campaign to siphon a victim's system login credentials.
- The compromised websites serving ClickFix prompts are abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, and www.caesarjaco.co[.]id.
The discovery of these malware families highlights the evolving tactics of cybercriminals, who are increasingly using sophisticated techniques to deliver payloads and steal sensitive information. This means that organizations and individuals must be vigilant and take steps to protect themselves from these types of attacks. By implementing robust security measures and educating users on how to identify and avoid phishing campaigns, we can reduce the risk of these types of attacks and protect our sensitive information.
The use of sophisticated techniques by cybercriminals to deliver payloads and steal sensitive information is a significant concern for organizations and individuals. If we do not take steps to protect ourselves from these types of attacks, we risk losing sensitive information and disrupting operations.
