Hackers Conceal Malware in English Words to Evade Detection
A new malware campaign, ClearFake, uses a loader called WordlistLoader to hide malicious code within sequences of English words, making static analysis more difficult and delivering the Amatera Stealer.
A novel Windows malware campaign is employing an ingenious technique to conceal malicious code by embedding it within sequences of ordinary English words. This method, identified by researchers at GenDigital and dubbed WordlistLoader, makes the malware significantly harder to detect through static analysis, as security tools initially encounter readable text rather than obvious shellcode.
The campaign is part of the long-running ClearFake operation, which compromises legitimate websites to present fake CAPTCHA prompts. These deceptive prompts trick unsuspecting users into executing malicious commands via the Windows Run dialog, ultimately leading to the deployment of the Amatera Stealer, an information-stealing malware.
WordlistLoader stores its next-stage code as a list of common English words. Each word in the sequence corresponds to a single byte, determined by a build-specific list containing 256 unique words. The loader then processes this word sequence, identifies each word's position in the list, and reconstructs the executable malware byte by byte in memory. This obfuscation technique bypasses traditional signature-based detection methods.
Further analysis revealed a variant of WordlistLoader that replaces the English word list with UUID values, where each UUID represents a 16-byte chunk of code. This demonstrates the operators' flexibility in adapting their encoding methods while maintaining the core execution flow, further complicating analysis.
Before launching the reconstructed payload, WordlistLoader performs several defensive evasion maneuvers. It checks for existing copies of itself, attempts to restore altered system module functions, and interferes with Windows event logging. These actions are designed to hinder security monitoring and forensic investigations.
The infection chain begins when attackers inject JavaScript into legitimate websites. This script can utilize techniques like EtherHiding to retrieve malicious content from blockchain smart contracts before displaying a fake CAPTCHA. When a user clicks the fake prompt, a command is copied to the Windows clipboard, and the user is instructed to open the Run dialog and paste it. This action unknowingly initiates a hidden command process that accesses a remote WebDAV share and launches a malicious DLL using rundll32.
This delivery method is particularly effective as it leverages built-in Windows components, circumventing the need for traditional software exploits. The ultimate payload is Amatera Stealer (also known as ACR Stealer), which has been actively updated with enhanced code obfuscation, methods to evade security hooks, and routines to recover protected browser encryption keys, including those protected by Chromium's Application-Bound Encryption.
Users are strongly advised to treat any CAPTCHA, browser warning, or website verification request that prompts them to open the Run dialog, Terminal, Command Prompt, or PowerShell as malicious. Legitimate CAPTCHA services do not require users to paste commands into Windows. Organizations should monitor for unusual rundll32 activity, clipboard-triggered command execution, WebDAV connections, and suspicious visits to compromised websites.