Cybersecurity researchers have identified two malware families, WordlistLoader and SynkLoader, being used in separate attack campaigns against Windows users. WordlistLoader is linked to ClearFake attacks and is mainly used to deliver Amatera Stealer, also known as ACR Stealer or AcridRain Stealer. At the same time, SynkLoader is being distributed through Microsoft Teams phishing campaigns to steal Windows login credentials. Researchers believe these attacks could also support ransomware operations or the sale of access to compromised networks.
WordlistLoader is being delivered through a ClickFix technique that uses fake CAPTCHA verification pages to trick people into running malicious commands themselves. Victims visiting compromised legitimate websites are shown a fake “I’m not a robot” check and are guided through instructions that copy a command to the clipboard. They are then asked to paste that command into the Windows Run dialog and execute it. Once this happens, WordlistLoader is downloaded and eventually helps launch Amatera Stealer on the infected system.
The fake CAPTCHA pages are created using malicious JavaScript injected into compromised websites, with the code hidden inside a Base64 encoded blob. That code retrieves additional JavaScript from a blockchain based smart contract, a method known as EtherHiding, allowing attackers to dynamically change parts of the attack. Researchers also found that ClearFake campaigns have abused the legitimate jsDelivr content delivery network to host malicious JavaScript. This combination of compromised websites, trusted services and blockchain hosted content makes the campaign harder to detect and maintain.
The ClickFix command also uses several Windows components to reduce visibility during execution. It can use conhost to start a hidden cmd process, connect to a remote WebDAV location through pushd and then launch the downloaded loader using rundll 32. More advanced versions use conhost in headless mode and hide important command elements through environment variable techniques. According to Microsoft, these methods reduce what the victim can see while making static analysis and detection more difficult.
WordlistLoader acts as an intermediate stage rather than being the final stealer itself. Its main job is to reconstruct shellcode that provides the entry point for later stages of the infection and eventually allows Amatera to load. The loader hides this shellcode as a sequence of ordinary English words, with each word representing one byte, which explains its name. Researchers also discovered another version that stores the encoded data using 16 byte UUID chunks instead of a word list.
The Amatera stealer delivered through this chain has also received several technical changes designed to make analysis and detection harder. Its newer version includes stronger static obfuscation, hardened system call handling through the WoW64 transition and dynamically created x64 indirect syscall trampolines using Heaven’s Gate. Researchers also observed a redesigned application bound encryption bypass that appears to have been influenced by techniques associated with Remus Stealer. These changes show how the malware continues to evolve.
Separately, SynkLoader has been observed in Microsoft Teams phishing attacks where criminals impersonate an organisation’s IT help desk. The victim is persuaded to install an MSI file presented as a legitimate PowerShell Cleaner and hosted through Microsoft Azure file storage, making the download appear more trustworthy. Once installed, the malware launches a Python based loader that communicates with its command and control infrastructure. Researchers identified several modules, including system profiling, persistence, credential theft, network tunnelling, remote command execution and VNC based desktop control.
One of SynkLoader’s most notable components is called PhishLocker, which creates a fake Windows lock screen designed to capture the victim’s login password. The stolen password could give attackers additional opportunities to move through corporate networks, especially where single sign on is widely used. Other modules can create scheduled tasks for persistence, redirect network traffic, execute PowerShell commands and remotely control the desktop. Researchers suspect the toolkit may be connected to ransomware activity or an initial access operation because of its focus on collecting information about corporate environments.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
