Skip to content

WordlistLoader / SynkLoader: new ClearFake loaders delivering Amatera (ACR) Stealer

Summary

Gen Digital Threat Research (via The Hacker News, August 24, 2026) documented two new Windows loader families, WordlistLoader and SynkLoader, that deliver Amatera Stealer (also known as ACR Stealer / AcridRain, an information stealer reportedly sold as malware-as-a-service) through ClearFake / ClickFake fake-CAPTCHA campaigns. The chains inject Base64-encoded JavaScript on compromised or SEO-poisoned websites, then use EtherHiding (payload retrieval via blockchain smart-contract data) and, in recent revamps, hosting of malicious JavaScript on cdn.jsdelivr[.]net. The campaigns overlap with the WebDAV-ClickFix delivery shape Microsoft described in its ACR Stealer reporting, including a headless conhost -headless variant with delayed environment-variable expansion.

Tags

WordlistLoader chain

  • Initial access is a ClearFake fake CAPTCHA page on a compromised or SEO-poisoned website that displays a clipboard-runnable command (ClickFix-style).
  • The command launches a hidden cmd.exe (recorded variants include headless conhost -headless with delayed environment-variable expansion to hide the payload strings) and uses pushd to mount a WebDAV share, then rundll32.exe to load the remote DLL.
  • The injected web payload is Base64-encoded JavaScript fetched from a remote source; EtherHiding resolves follow-on payloads/C2 by querying data stored in a blockchain smart contract.
  • The revamp hosts the malicious JavaScript on cdn.jsdelivr[.]net, a widely trusted CDN, a deliberate trust-shift from the original compromised-site hosting.
  • The final stage is Amatera Stealer: browser credentials, session tokens, authentication artifacts, and documents.

SynkLoader chain

  • A parallel loader observed in the same campaign wave.
  • Phishes Windows passwords, Gen Digital assesses the objective as access sales, likely feeding ransomware operations.
  • Shares the ClearFake delivery and loader infrastructure patterns with WordlistLoader.

Indicators

Compromised / abusing domains recorded by Gen Digital: - abogadosrosarinos[.]com - aptisweb[.]com - avene-hebergement[.]com - https-xhamster[.]com - www.caesarjaco.co[.]id - skybap[.]shop

Defender heuristics

  1. Treat any website-presented "verification" prompt with a clipboard command as hostile, ClearFake/ClickFake campaigns reuse the ClickFix primitive, and the fake CAPTCHA framing (not a genuine browser challenge) is the visual tell.
  2. Hunt conhost.exe --headless spawning cmd.exe and delayed environment-variable expansion around pushd + rundll32 WebDAV execution, this is the shared shape between this campaign and Microsoft's documented ACR Stealer WebDAV campaign.
  3. Add cdn.jsdelivr[.]net scope to JS execution review: legitimate CDN use is normal, but a JS file fetched by an on-page inline/encoded loader from the CDN as the last stage of a fake-CAPTCHA chain is the EtherHiding→CDN revamp signature.
  4. Monitor blockchain dead-drop lookups (public RPC/Web3 queries from Office/browser/terminal processes) as an EtherHiding indicator.
  5. Track the loader names: WordlistLoader and SynkLoader are new family labels; correlate against the existing ACR Stealer / Amatera / AcridRain cluster (see the ACR Stealer page) rather than treating them as unrelated.

Sources