--- title: WordlistLoader Delivers Amatera via ClickFix, SynkLoader Steals Windows Passwords - Capstone Technologies Group description: WordlistLoader delivers Amatera Stealer via ClickFix attacks. SynkLoader steals Windows passwords through fake lock screens. Understand the infection chain… canonical_url: https://captechgroup.com/threat-intelligence-center/wordlistloader-delivers-amatera-via-clickfix-synkl-50482e language: en-GB date: 2026-08-25T12:35:51Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/wordlistloader-delivers-amatera-via-clickfix-synkl-50482e. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 6098 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/wordlistloader-delivers-amatera-via-clickfix-synkl-50482e. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Gen Digital researchers have identified **WordlistLoader**, a new malware family that delivers **Amatera Stealer** (also tracked as ACR Stealer or AcridRain Stealer) through **ClearFake** campaigns using the ClickFix technique. The activity described here was documented by [The Hacker News](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html "Source: The Hacker News"). **Key Insight:** The entry point is a website your staff already trust, compromised with injected JavaScript that displays a fake CAPTCHA check. The flow is simple enough that it works on careful people. A visitor clicks "I'm not a robot," a malicious command is silently copied to their clipboard, and on-screen instructions tell them to paste it into the Windows Run dialog and press Enter. > "Once the visitor clicks on the 'I'm not a robot' checkbox, they're walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it, leading to the download of WordlistLoader that ultimately results in the execution of Amatera," said security researcher Vojtěch Krejsa. That single paste runs the whole chain: - `conhost.exe --headless` launches a hidden `cmd.exe` so no console window appears on screen - `pushd` maps a remote WebDAV share over HTTPS, keeping the payload off local disk - `rundll32.exe` loads WordlistLoader from that share, which rebuilds shellcode and reflectively loads Amatera 4.3.3-alpha1 The injected JavaScript is delivered as a Base64 blob that pulls further code from a smart contract on the blockchain, a technique called EtherHiding. Because the code lives on-chain, the operators swap out burned URLs for fresh ones as fast as hosting providers take them down. Recent ClearFake activity has also staged malicious PowerShell through the legitimate `cdn.jsdelivr.net` CDN, so the traffic looks like an ordinary developer dependency. The end result is an information stealer running on an employee endpoint with no installer prompt and no obvious file dropped. Amatera collects saved credentials, session data, and browser secrets, which gives attackers working logins to your email, VPN, and SaaS accounts under a real user identity. ## Infection Mechanics: WordlistLoader, SynkLoader, and the Malware Ecosystem The execution chain that lands WordlistLoader on disk relies entirely on binaries already present in Windows. The pasted command uses `conhost.exe --headless` to spawn a hidden `cmd.exe`, mounts a remote WebDAV share over HTTPS with `pushd`, and then calls `rundll32.exe` to load the DLL straight from that share. Microsoft recorded three variants of this pattern: direct rundll32 invocation, a pushd-mounted share followed by rundll32, and the headless obfuscated version that matches the WordlistLoader chain. That third variant adds environment variable obfuscation with delayed expansion to hide the strings `pushd`, `rundll32`, and the remote hostname from static inspection. For a [SOC](https://captechgroup.com/services/managed-it-solutions "Comprehensive Managed IT Services | Dayton, Columbus, Cincinnati"), the practical consequence is that command-line telemetry may show assembled variables instead of readable indicators, and the payload never touches local storage as a conventional file write. The JavaScript staging layer is worth separate attention. Injected Base64 blobs on compromised sites pull further script from a smart contract on the blockchain, the technique known as EtherHiding, which lets operators rotate burned URLs without touching the victim site again. Recent activity has also abused `cdn.jsdelivr[.]net` to host what Expel described as a malicious PowerShell script rather than the JavaScript the CDN is intended for. Blocking a single domain does little when the resolver logic lives on-chain. A parallel ACR Stealer chain skips WebDAV entirely and spawns MSHTA to pull remote HTA content from actor-controlled infrastructure. That HTA drops a VBScript loader, which decodes and runs PowerShell that retrieves a JPEG from an image-hosting service and extracts the stealer from it in memory. The Python-based loaders Microsoft tracked between late April 2026 and mid-June 2026 have now been swapped for WordlistLoader in the Amatera path. WordlistLoader itself is an intermediate stage whose job is to rebuild shellcode that serves as the entry point for what follows. The name comes from its encoding: the shellcode is stored as a sequence of plain English words, one word per byte. Gen Digital also found a variant that swaps the wordlist for an array of 16-byte UUID-encoded chunks. Before handing off, it uses a hardware-breakpoint technique to bypass Event Tracing for Windows, so the activity leaves no ETW record for your [EDR](https://captechgroup.com/services/cybersecurity-services "Cybersecurity Services | Protect Your Business with Capstone Technologies") to correlate. The reconstructed shellcode invokes a reflective loader that unpacks Amatera 4.3.3-alpha1. This build adds updated static obfuscation, hardened syscall invocation through the WoW64 transition, dynamically generated x64 indirect-syscall trampolines called via Heaven's Gate, and a redesigned application-bound encryption bypass that appears modeled on Remus Stealer. The ABE bypass matters because it targets the browser protection meant to keep session cookies from being reused off-machine. SynkLoader arrives through a different door. Expel observed the campaign in mid-August 2025, with an actor emailing from a `@company.onmicrosoft.com` address under the display name "IT Service Desk" and persuading the target to install an MSI hosted at `https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi`. The Azure blob endpoint gives the download Microsoft-looking provenance. The MSI poses as a "PowerShell Cleaner," extracts a ZIP plus a PowerShell script that runs in memory, and launches a Python loader. That loader picks one of three hard-coded C2 domains, checks in at random, and sleeps 90 to 120 seconds between requests before decrypting and executing responses. Seven modules have been identified: - **System Profiler**, a C# DLL for host reconnaissance - **Persistence Module**, a native DLL creating a randomly named scheduled task that fires at every logon and daily at 10 a.m. - **PhishLocker**, which paints a fake Windows lock screen to harvest the user's actual domain password - **TrafficRedirector**, a reverse proxy into local network services - **Interactive Shell**, a PowerShell RAT module - **StreamMaster**, a VNC module with mouse and keyboard control - **Status Checker**, reporting which modules are live PhishLocker is the credential access piece that distinguishes this toolkit. A password typed into that overlay is valid for VPN, email, and file shares, and Expel assesses the operator may be a ransomware group or an initial access broker. ## What Attackers Steal and How It's Used Against You The password **PhishLocker** captures is not a throwaway. When the module paints a fake Windows lock screen over the desktop, the user types the same credential they use for domain sign-in, and in most environments that credential also opens Microsoft 365, VPN, file shares, and any internal application tied to single sign-on. One employee re-authenticating to what looks like a routine screen lock hands over the account your directory trusts. That is the pivot point. Amatera Stealer harvests what lives in the browser, which means saved logins and active session tokens for webmail, cloud consoles, payroll portals, and banking. Session tokens matter more than passwords in practice because they represent an already-authenticated state, so an attacker replaying one walks into your tenant without triggering a password reset alert or a fresh MFA prompt. The **SynkLoader** module set turns that single foothold into a position inside your network. **TrafficRedirector** operates as a reverse proxy, letting the operator reach local network services from the compromised machine or route their own internet traffic through your address space. Your firewall sees an internal host talking to internal resources, which is exactly what it is supposed to see. - **StreamMaster** streams the desktop over VNC with live mouse and keyboard control, so an operator can work inside applications the user has already authenticated to, including finance and ERP systems that never expose an API. - **Interactive Shell** executes PowerShell and returns the output, giving the attacker a general-purpose remote access trojan for enumeration and staging. - **System Profiler** collects details about the host, which is how operators decide whether your environment is worth escalating in or worth selling. - The **Persistence Module** registers a randomly named scheduled task that runs at every login and again daily at 10 a.m., so a reboot or a single cleaned process does not end the access. Gen Digital and Expel both note the likely commercial motive: the operators appear to be either a ransomware group or an initial access broker selling entry to one. That distinction changes your timeline. If access is sold, the buyer arrives later with their own tooling, and the stolen credentials from the earlier stage still work when they do. The financial exposure comes in layers. There is direct fraud where banking and payment portal sessions are used for transfers or invoice changes. There is the incident response bill, which grows with every day the persistence mechanism goes unnoticed because you have to assume every account touched by that host is compromised. Then there is ransomware recovery, which brings downtime across the systems the operator reached through the proxy rather than just the one machine that opened the fake CAPTCHA or the fake IT ticket. Regulatory exposure follows the data, not the malware. If a stealer pulled browser-stored credentials for a system holding personal data, or if remote desktop control was used inside an application containing client records, you are in notification territory under GDPR, state breach statutes, and sector rules. The practical problem for your legal and compliance team is proof of scope. Modules that stream a desktop and proxy traffic leave thin logs, so demonstrating what an attacker did not access is harder than demonstrating they were present. From fake lock screen to broker-sold access 1 The module paints a fake Windows lock screen over the desktop. The user types the credential used for domain sign-in, which in most environments also opens Microsoft 365, VPN, file shares, and single sign-on applications.High 2 Saved logins and active session tokens for webmail, cloud consoles, payroll portals, and banking are harvested. A replayed token represents an already-authenticated state, so it bypasses a fresh MFA prompt.High 3 The SynkLoader module set runs a reverse proxy on the compromised host, reaching local network services and routing operator traffic through internal address space. The firewall observes an internal host talking to internal resources.Medium 4 StreamMaster streams the desktop over VNC with mouse and keyboard control, so the operator works inside finance and ERP applications the user already authenticated to. Interactive Shell runs PowerShell for enumeration and staging while System Profiler collects host details.powershell.exe 5 The Persistence Module registers a randomly named scheduled task that runs at every login and again on a daily schedule, so a reboot or one cleaned process does not end access. Gen Digital and Expel note the operators may be a ransomware group or an initial access broker, and the stolen credentials still work when a buyer arrives with separate tooling.High ## Detection and Immediate Response for WordlistLoader and SynkLoader Start with the endpoint your user was sitting at. If anyone reports a CAPTCHA prompt or a "PowerShell Cleaner" install, pull `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU` on that host. The Run dialog keeps what was pasted into it, which gives you the command verbatim and confirms whether the paste actually executed. In the same 24 hours, hunt for the installer path. Search process telemetry for `msiexec.exe` executions where the package came from an Azure blob endpoint, specifically `filereserve.blob.core.windows[.]net`, the host serving `331.msi` in the campaign Expel documented. Any MSI pulled from consumer or blob storage into a user profile directory deserves an analyst looking at it the same day. Then check scheduled tasks. SynkLoader's persistence module creates a randomly named task with two triggers: at user logon and daily at 10 a.m. That trigger pair is unusual enough to be a reliable hunt. Enumerate tasks created in the last 30 days and flag any that combine a logon trigger with a fixed 10:00 daily run, then look at what the action points to. Mail and Teams review comes next. Search your tenant for inbound messages and chats from `*.onmicrosoft.com` senders using the display name "IT Service Desk" or similar helpdesk phrasing. Those default Microsoft 365 domains belong to other tenants, so a legitimate internal helpdesk almost never uses one. For network detection, three items are worth writing rules for: - `powershell.exe` or `mshta.exe` making outbound HTTPS requests, including PowerShell content pulled from `cdn.jsdelivr[.]net`, which the operators abuse to stage scripts on a legitimate CDN. - Repeating check-ins with a 90 to 120 second sleep across three rotating domains, the beacon pattern of the Python loader. - Traffic to the compromised sites hosting the fake verification prompts, including `abogadosrosarinos[.]com`, `aptisweb[.]com`, `avene-hebergement[.]com` and `skybap[.]shop`. Block them at the gateway and query proxy logs backward for any user who reached them. Within the week, reset passwords and revoke active sessions for every user on an affected host, then review VPN and RDP authentication for that account. The TrafficRedirector module turns the workstation into a reverse proxy into your internal services, so east-west connections from a normal user endpoint to file servers, domain controllers or management interfaces are the signal to chase. StreamMaster adds VNC-style desktop control, meaning some of the activity will look like the legitimate user working. Because the loader in the Amatera chain uses hardware breakpoints to bypass Event Tracing for Windows, script block and module logging may simply not record the stage you most want to see. Detection has to lean on process lineage and behavioral telemetry instead. In environments Capstone manages, Adlumin correlates the authentication side of this, flagging logons from a host that just beaconed and sign-ins that follow a credential capture, which is where stolen passwords surface first. Longer term, three controls reduce the attack surface these families depend on. Disable the WebClient service where WebDAV is not needed, block `msiexec.exe` from executing packages in user-writable directories through AppLocker or WDAC, and require phishing-resistant MFA on VPN, remote desktop gateways and administrative accounts so a captured password alone does not grant access. Then re-run the scheduled task hunt monthly. ## Protecting Against ClickFix and Credential Theft at Scale The highest-value preventive control is closing the paste-to-execute path. Remove the Run dialog for standard users through Group Policy (`User Configuration\Administrative Templates\Start Menu and Taskbar\Remove Run menu from Start Menu`), and disable the WebClient service on workstations that have no business need for WebDAV with `sc config WebClient start= disabled`. Without WebClient, the remote share mount fails and the loader DLL never reaches `rundll32.exe`. Back that up with application control. A WDAC or AppLocker policy that blocks `rundll32.exe` from loading DLLs over UNC and HTTPS paths breaks the delivery step regardless of which loader family is in rotation, and it also stops the MSHTA variant that pulls remote HTA content. If you cannot deploy full application control, enable Microsoft Defender Attack Surface Reduction rules covering script-launched executable content and put them in block mode rather than audit after a short pilot. Protect the credential store next, because a stolen Windows password is the payload the fake lock screen is built to collect. Turn on LSA protection by setting `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL` to `1`, and enable Windows Defender Credential Guard through `Computer Configuration\Administrative Templates\System\Device Guard\Turn On Virtualization Based Security` with UEFI lock. Deploy Windows LAPS so every machine holds a unique, rotating local administrator password, which prevents a single harvested local credential from opening every other workstation on your network. Then make the password itself insufficient. Enforce phishing-resistant MFA (FIDO2 keys or Windows Hello for Business) on Microsoft 365, VPN, and remote administration, so a captured domain password produces a failed sign-in instead of a session. Audit which accounts still allow password-only authentication and fix those first, starting with anyone holding local administrator rights. Reduce what an operator can reach once a module lands. Disable Remote Desktop and WinRM on endpoints where administrators do not actually use them, and where they are required, restrict inbound access to jump hosts by IP through Windows Firewall rules. Blocking outbound WebDAV and raw HTTP CONNECT traffic to non-approved hosts at the egress point removes the reverse-proxy and desktop-streaming channels the SynkLoader modules depend on. - Sinkhole the compromised sites serving the fake CAPTCHA prompts at your DNS resolver, including `abogadosrosarinos[.]com`, `aptisweb[.]com`, `avene-hebergement[.]com`, `skybap[.]shop`, and `www.caesarjaco.co[.]id`. - Alert on, do not blanket-block, script pulls from `cdn.jsdelivr[.]net`, since the CDN is legitimate and the malicious repositories are taken down and replaced frequently. - Route browsing for finance, HR, and IT administrators through remote browser isolation so injected JavaScript executes off the endpoint. - Restrict Microsoft Teams external access to a federation allowlist, which stops a stranger on an `onmicrosoft.com` tenant from opening a chat as your help desk. **SentinelOne** blocks the loader execution chain and the tampering that follows it across managed environments, including the hardware-breakpoint ETW bypass that hides activity from native Windows telemetry. For the human layer, train staff on one rule that covers the whole technique: no legitimate website or CAPTCHA ever asks you to copy a command and run it. Add a second rule for the help desk pretext. Your IT team will never send an MSI from a file-sharing link and ask a user to install it during a chat, and users should verify any such request through a known internal number before clicking. Run a short simulation that includes a fake verification page, then track how many people report it rather than how many paste the command. ## Key Actions and Next Steps Gen Digital and Expel both assess these toolkits as feeding something larger. The SynkLoader operator's end goal is unconfirmed, but researchers suspect the kit belongs to a ransomware group or an initial access broker. That assessment should shape how you classify an infection: a confirmed hit on either loader is a credential compromise event, not a malware cleanup ticket. The practical consequence is that reimaging the endpoint settles nothing. Whatever left that machine already left it. Your first priority is resetting credentials for the accounts with the widest reach, in this order: domain administrators, Microsoft 365 and Exchange administrators, cloud and SaaS service accounts, and then the affected user's own account along with any session it held. Revoking active tokens matters as much as changing the password, because a valid session survives a password reset in many identity platforms. Two details from the research affect how much you can trust your own telemetry. WordlistLoader uses hardware breakpoints to bypass Event Tracing for Windows, which means the usual event stream your tooling depends on may simply not contain the activity. And because ClearFake pulls its next-stage JavaScript from a smart contract on the blockchain, operators replace burned URLs with fresh ones quickly, so an indicator list from last month tells you very little about this week. Treat quiet logs as inconclusive rather than clean. The value of finding this early is narrow and specific: an access broker cannot sell what you have already invalidated, and a stealer infection caught before the credentials are used stays a single-endpoint problem instead of a network-wide one. Credential reset order after a loader infection 1 Reset the accounts with the widest reach first. Treat a confirmed hit on either loader as a credential compromise event rather than a malware cleanup ticket.High 2 Rotate tenant and mail administrator credentials next, since these accounts control identity and message flow.High 3 Replace secrets held by non-interactive service accounts, which rarely have a human watching their sign-in activity.Medium 4 Reset the user's own account and revoke live tokens. A valid session survives a password reset in many identity platforms.Medium 5 WordlistLoader uses hardware breakpoints to bypass Event Tracing for Windows, and ClearFake rotates staging URLs pulled from a blockchain smart contract. Treat quiet logs as inconclusive, and reimaging alone as insufficient.Event Tracing for WindowsLow ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-08-25T12:35:51Z", "datePublished": "2026-08-25T12:35:51Z", "description": "WordlistLoader delivers Amatera Stealer via ClickFix attacks. SynkLoader steals Windows passwords through fake lock screens. Understand the infection chain…", "headline": "WordlistLoader Delivers Amatera via ClickFix, SynkLoader Steals Windows Passwords", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/wordlistloader-delivers-amatera-via-clickfix-synkl-50482e" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/wordlistloader-delivers-amatera-via-clickfix-synkl-50482e" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```