Do Son 
Infection chain overview | Image: Gen Threat Labs
At a glance
| Malware family | WordlistLoader (loader); Amatera Stealer / ACR Stealer (payload) |
| Threat actor | Amatera sold as a service by an actor tracked as SheldIO (per prior reporting) |
| Targets | Windows users who hit compromised sites; browser and wallet data |
| Delivery vector | ClearFake fake-CAPTCHA (ClickFix) on hacked websites |
| Key capabilities | Shellcode rebuilding, unhooking, ETW bypass, data theft |
| Source | Gen Threat Labs; Proofpoint; Red Canary |
TL;DR
Gen Threat Labs found WordlistLoader malware, a new loader for Amatera Stealer. It arrives through ClearFake fake-CAPTCHA lures. The loader hides its payload as plain English words.
What happened
Gen Threat Labs identified a fresh loader named WordlistLoader. It delivers Amatera Stealer, an infostealer also known as ACR Stealer. Researchers call Amatera one of the most prevalent stealers in their user base.
The attack begins on a hacked but legitimate website. Injected JavaScript overlays a fake CAPTCHA. This is the ClearFake technique, and it has proven very effective at tricking users.
WordlistLoader replaces the Python-based loaders seen in earlier waves. As Gen puts it, the pattern points to “an evolution of the distribution chain”. The delivery method stays similar, but the tooling is new.
Delivery and infection chain
Victims click an “I’m not a robot” box on the fake prompt. The page then walks them through the ClickFix flow. A command lands in the clipboard, and users paste it into the Windows Run box.
That command maps a remote WebDAV share and loads a DLL. The DLL is WordlistLoader. Its job is to rebuild the shellcode that starts the next stage.
Why the name WordlistLoader
The loader stores its shellcode as a list of plain English words. Each word maps to one byte. A build-specific wordlist of 256 words defines the mapping.
To rebuild the code, the loader looks up each word and writes its index. One variant swaps the words for UUIDs instead. Both methods reach the same result.
Evasion and defense bypass
WordlistLoader runs two clear evasion steps before it hands off. First, it unhooks loaded modules by restoring clean bytes from disk. This strips out monitoring hooks that security tools place.
Second, it blinds Event Tracing for Windows. It sets a hardware breakpoint on a logging function, then skips the real code. The call still returns success, so nothing looks wrong.
The shellcode adds an anti-emulation stub. It runs long delay loops that waste time inside sandboxes. You can read the full Gen Threat Labs analysis of WordlistLoader for the technical detail.
What Amatera does next
After decryption, a reflective loader unpacks Amatera Stealer. The stealer targets browser data, saved passwords, and crypto wallets. Prior reporting from Proofpoint ties it to a service seller and a paid subscription model.
The latest builds harden the stealer further. Amatera now uses heavier code obfuscation and split API hashing. It also reworked how it reaches the Windows kernel through the WoW64 layer.
A revamped browser key theft
Amatera also rebuilt its Application-Bound Encryption bypass. The new method closely mirrors the Remus and Lumma stealers. Gen believes Amatera’s version was inspired directly by that code.
The technique hunts a browser’s memory for a protected master key. Then it runs code inside the browser to unlock it. This lets the stealer read saved secrets from Chromium browsers.
How to stay protected
Never run a command a website tells you to paste. A real CAPTCHA never asks for that step. Leave any page that pushes the Run dialog.
Defenders should watch for rundll32 launching from user folders. Monitor odd WebDAV connections and clipboard-driven commands. Clipboard protection and updated endpoint tools also help block these lures.
The rise of WordlistLoader malware shows how loaders keep evolving. Because the delivery stays the same, user awareness matters most. Treat unexpected verification steps as a warning sign.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
