WordlistLoader is currently being distributed through ClearFake campaigns, which leverage the ClickFix (also known as FakeCaptcha) technique to trick users into executing malicious code. This loader is specifically used to deliver Amatera Stealer, also referred to as ACR Stealer or AcridRain Stealer. The attack chain typically involves fake CAPTCHA prompts that instruct users to paste and run a command, ultimately leading to system compromise.

Key observations from the research include:

• WordlistLoader uses wordlist-based payloads to stage its next-stage malware, making it harder for traditional signature-based detection to catch.
• SynkLoader is observed phishing for Windows passwords, likely targeting credential stores and browser data, and is believed to be part of an access-selling operation.
• Both loaders appear to be operated by threat actors who may be selling access to initial access brokers or ransomware groups.

The use of ClickFix in the wild continues to grow, as it exploits user trust in familiar UI elements like CAPTCHA widgets. Organizations should be cautious of unsolicited prompts that ask users to copy-paste commands into a terminal.

Recommended mitigations include:

• Enforcing application allowlisting to block execution of unsigned scripts or binaries.
• Restricting PowerShell and command-line usage to approved administrators.
• Monitoring for unusual child processes spawned from browsers or document viewers.
• Providing user awareness training on the dangers of pasting commands from web pages.

Source: The Hacker News

Are your security teams seeing an uptick in FakeCaptcha-related incidents, and how are you adapting your user education or endpoint controls to address it?