New Malware Families WordlistLoader and SynkLoader Target Windows Credentials and Deliver Amatera Stealer
Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, which are being used to deliver sophisticated payloads like Amatera Stealer and phish for Windows credentials, likely paving the way for ransomware operations.
Two emerging malware families, WordlistLoader and SynkLoader, have been identified by cybersecurity researchers, signaling new threats to Windows users. WordlistLoader is instrumental in distributing the Amatera Stealer through deceptive ClearFake campaigns, while SynkLoader focuses on phishing for Windows credentials. Both malware families are suspected of being used to provide initial access for subsequent ransomware attacks.
WordlistLoader's distribution method leverages the "ClickFix" technique, also known as "FakeCaptcha." This social engineering tactic tricks victims into executing malicious commands by presenting them with a fake CAPTCHA verification. Once a user interacts with the fake CAPTCHA, a malicious command is copied to their clipboard, instructing them to paste and execute it in the Windows Run dialog. This action ultimately leads to the download and execution of WordlistLoader, which then deploys the Amatera Stealer.
The ClickFix prompts are injected into legitimate websites that have been compromised with malicious JavaScript. This JavaScript, often encoded in Base64, fetches further malicious code from blockchain-based smart contracts using an "EtherHiding" technique. This allows attackers to dynamically execute code and easily swap out compromised URLs, making detection and takedown more challenging. Some of the compromised websites identified include abogadosrosarinos[.]com and https-xhamster[.]com.
Attackers are increasingly abusing legitimate Content Delivery Networks (CDNs) like "cdn.jsdelivr[.]net" to host their malicious PowerShell scripts. While CDNs are intended for legitimate JavaScript, threat actors exploit them for staging rogue payloads. Although CDN providers often move quickly to take down malicious repositories, the use of techniques like EtherHiding allows attackers to maintain operational continuity by quickly replacing compromised URLs.
The infection chain involves sophisticated command execution techniques. WordlistLoader uses "conhost.exe" to launch hidden "cmd.exe" processes, maps remote WebDAV shares using "pushd," and then executes the loader via "rundll32.exe." Advanced variants employ headless execution and obfuscation to conceal critical components like "pushd," "rundll32," and remote hostnames, reducing visibility and complicating analysis for both victims and security professionals.
WordlistLoader itself is an intermediate stage designed to reconstruct shellcode, serving as the entry point for subsequent payloads. It employs a hardware-breakpoint-based method to bypass Event Tracing for Windows (ETW), further minimizing its on-disk footprint and evading detection. The malware gets its name from its method of storing shellcode as a sequence of plain English words, where each word represents a single byte, though variants have been observed using UUID-encoded chunks.
SynkLoader, on the other hand, has been distributed through phishing campaigns impersonating Microsoft Teams. Threat actors send emails from seemingly legitimate "@<company>.onmicrosoft.com" domains, posing as IT support. They then trick users into downloading and installing a malicious MSI installer from a Microsoft Azure file storage endpoint, which ultimately leads to the theft of Windows credentials.
These new malware families highlight the evolving tactics of cybercriminals. The use of ClickFix and EtherHiding demonstrates a continued reliance on social engineering and complex evasion techniques. The distribution of Amatera Stealer and the credential-phishing capabilities of SynkLoader underscore the ongoing threat to sensitive data and the potential for these infections to serve as precursors to more damaging ransomware attacks.
The SynkLoader malware has resurfaced with advanced capabilities, including screen hijacking for password theft and multilingual support, indicating a significant evolution beyond its previously reported credential-stealing functions. This sophisticated multitool employs novel techniques, such as embedding malicious Python environments and leveraging COM interfaces for persistence, potentially signaling a precursor to more impactful ransomware deployments.