WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

SINGAPORE, 25 AUGUST 2026 —

Cybersecurity researchers at Gen Digital and Expel have identified two new malware families—WordlistLoader and SynkLoader—that are being used to deliver next-stage payloads, likely to ransomware groups.

“Once the visitor clicks on the ‘I’m not a robot’ checkbox, they’re walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it, leading to the download of WordlistLoader that ultimately results in the execution of Amatera,” Gen Digital security researcher Vojtěch Krejsa said.

The attackers inject malicious JavaScript as a Base64-encoded blob on real websites, which then fetches additional JavaScript from a smart contract stored on the blockchain—a technique known as EtherHiding. In recent months the campaigns have pivoted to hosting the rogue payloads on the legitimate CDN cdn.jsdelivr[.]net.

“Although the CDN is meant for hosting JavaScript, the threat actors are actually using it to host their malicious PowerShell script,” Expel noted in January.

The ClickFix command uses conhost.exe to launch a hidden cmd.exe process, maps a remote WebDAV share with pushd, and finally invokes rundll32.exe to load the loader. Microsoft has previously documented similar WebDAV-based approaches in other campaigns.

WordlistLoader reconstructs shellcode from an encoded wordlist—each English word represents one byte—before unpacking and loading Amatera 4.3.3-alpha1. Gen Digital also identified a variant that swaps the wordlist for 16-byte UUID-encoded chunks. The loader employs a hardware-breakpoint-based method to bypass Event Tracing for Windows and avoid leaving traces.

The latest Amatera version adds updated static obfuscation, hardened syscall invocation via WoW64 transition, dynamically generated x64 indirect-syscall trampolines invoked through Heaven’s Gate, and a redesigned application-bound encryption bypass.

Separately, Expel detected SynkLoader being distributed via a Microsoft Teams phishing campaign in mid-August 2025. An attacker impersonating an IT service desk sent a target an MSI installer hosted on Microsoft Azure Blob Storage under the guise of a PowerShell Cleaner.

“Someone using a <username>@<company>.onmicrosoft.com email reached out to the target using the name IT Service Desk (<Fake Name>),” Expel security researcher Marcus Hutchins said.

When executed, the MSI drops a ZIP archive and an in-memory PowerShell script that extracts and runs a Python-based loader. The loader randomly checks in with one of three hard-coded command-and-control domains every 90 to 120 seconds, then decrypts and executes server responses. At least seven modules have been identified; the end goal is suspected to be ransomware operations or initial access brokering.

For Malaysian businesses, the campaigns highlight how threat actors continue to abuse legitimate infrastructure—CDNs and cloud storage—and social-engineering lures such as fake IT help desks to deliver advanced stealers and credential phishing.

Related: Microsoft · Singapore