WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
-
Cybersecurity researchers have identified two new malware families—WordlistLoader and SynkLoader—that are being used to deliver next-stage payloads and potentially sell access to ransomware operations. The findings come from Gen Digital, which detailed how these loaders operate in active campaigns.
WordlistLoader is currently being distributed through ClearFake campaigns, which leverage the ClickFix (also known as FakeCaptcha) technique to trick users into executing malicious code. This loader is specifically used to deliver Amatera Stealer, also referred to as ACR Stealer or AcridRain Stealer. The attack chain typically involves fake CAPTCHA prompts that instruct users to paste and run a command, ultimately leading to system compromise.
Key observations from the research include:
- WordlistLoader uses wordlist-based payloads to stage its next-stage malware, making it harder for traditional signature-based detection to catch.
- SynkLoader is observed phishing for Windows passwords, likely targeting credential stores and browser data, and is believed to be part of an access-selling operation.
- Both loaders appear to be operated by threat actors who may be selling access to initial access brokers or ransomware groups.
The use of ClickFix in the wild continues to grow, as it exploits user trust in familiar UI elements like CAPTCHA widgets. Organizations should be cautious of unsolicited prompts that ask users to copy-paste commands into a terminal.
Recommended mitigations include:
- Enforcing application allowlisting to block execution of unsigned scripts or binaries.
- Restricting PowerShell and command-line usage to approved administrators.
- Monitoring for unusual child processes spawned from browsers or document viewers.
- Providing user awareness training on the dangers of pasting commands from web pages.
Source: The Hacker News
Are your security teams seeing an uptick in FakeCaptcha-related incidents, and how are you adapting your user education or endpoint controls to address it?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login