WordlistLoader Delivers Amatera via ClickFix as SynkLoader Phishes Windows Credentials

Summary

Researchers detail WordlistLoader’s delivery of Amatera through ClearFake ClickFix campaigns and SynkLoader’s use in Teams phishing to capture Windows credentials. The toolkit may be linked to ransomware access sales, but its operators’ goals are unclear.

Key points

• ClearFake ClickFix prompts on compromised websites trick victims into running commands that download WordlistLoader, which delivers Amatera Stealer.
• The campaigns use EtherHiding to fetch JavaScript from blockchain-stored smart contracts; ClearFake actors have also used jsDelivr to stage malicious scripts.
• WordlistLoader launches through remote WebDAV and can use headless command execution; its shellcode is encoded as English words or UUID chunks and uses a hardware-breakpoint method to bypass ETW.
• The shellcode reconstructs an entry point for later stages, including a reflective loader that unpacks Amatera 4.3.3-alpha1.
• SynkLoader was distributed through Microsoft Teams phishing using a fake IT Service Desk and an MSI installer presented as a PowerShell Cleaner.
• SynkLoader modules include a fake Windows lock screen to capture passwords, persistence, system profiling, a reverse proxy, an interactive shell, and VNC control.
• Researchers say the toolkit may be associated with a ransomware group or initial access broker; the operator’s end goals are unclear.