WordlistLoader and SynkLoader: Two New Criminal Tools Target Credentials and Network Access

Two independent discoveries, one common goal

In recent months, three security teams have documented two separate malware campaigns sharing the same objective: gaining initial access to Windows machines and setting the stage for follow-on attacks. Gen Digital identified WordlistLoader, an intermediate loader used to deliver Amatera Stealer, also known as ACR Stealer or AcridRain Stealer. Microsoft confirmed that WordlistLoader replaced previous Python loaders between late April and mid-June 2026. Expel, for its part, reconstructed a campaign based on SynkLoader, a toolkit distributed through phishing on Microsoft Teams. Both families are described as tools for delivering follow-on payloads or selling access to third parties.

WordlistLoader: the code hidden in a wordlist

The campaign leading to WordlistLoader uses the ClearFake technique. On compromised legitimate websites, malicious JavaScript is injected as a Base64-encoded blob. The blob retrieves a second JavaScript from a smart contract stored on a blockchain—a technique called EtherHiding—and executes it dynamically. Using the blockchain allows attackers to update payloads even after malicious repositories hosted on legitimate CDNs such as cdn.jsdelivr[.]net are taken down. Observed compromised sites include abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, www.caesarjaco.co[.]id, and skybap[.]shop.

The ClickFix command shown to the victim starts an execution chain that, according to Microsoft, has three variants. The simplest calls rundll32.exe directly. The second mounts a remote WebDAV share with pushd and then launches rundll32.exe. The third, more advanced, runs everything headless and obfuscated: conhost.exe --headless suppresses console windows, while obfuscation through environment variables with delayed expansion hides critical components such as pushd, rundll32, and the remote host name. This third variant corresponds to the WordlistLoader infection chain.

WordlistLoader is the intermediate stage that reconstructs shellcode. The name comes from the shellcode encoding format: a sequence of English words, where each word represents a byte. Gen Digital also identified a variant that replaces the wordlist with an array of 16-byte UUID chunks. Once reconstructed, the shellcode uses a reflective loader to unpack and load Amatera 4.3.3-alpha1. The same reflective loader had already been observed in late April 2026 in another ClickFix campaign. To avoid leaving traces, WordlistLoader uses hardware breakpoints to bypass Event Tracing for Windows (ETW).

Amatera 4.3.3-alpha1: enhanced evasion with WoW64 and Heaven's Gate

The latest version of Amatera Stealer incorporates several updated evasion techniques. Static obfuscation has been revised. System calls have been hardened through a WoW64 transition, with x64 indirect syscall trampolines generated dynamically and invoked through Heaven's Gate. In addition, the application-bound encryption (ABE) bypass has been redesigned, drawing inspiration from Remus Stealer. ACR Stealer has also been distributed through ClickFix prompts that run MSHTA to retrieve HTA content from an attacker-controlled domain. A VBScript loader decodes and executes PowerShell, which downloads a JPEG image from an image hosting service and extracts the stealer payload from memory, reducing artifacts on disk.

SynkLoader: the fake Teams help desk that asks for your password

In mid-August 2025, Expel detected a phishing campaign on Microsoft Teams. An account in the format <username>@<company>.onmicrosoft.com, the default Microsoft 365 domain for companies, contacts the victim posing as "IT Service Desk" with a fictitious name. The attacker convinces the user to download and install an MSI package from an Azure Blob Storage endpoint: https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi. The MSI file presents itself as "PowerShell Cleaner". When executed, it extracts a ZIP archive and a PowerShell script; the script runs in memory automatically. It extracts the archive contents and starts a Python loader that randomly contacts one of three hardcoded C2 domains, sleeping between 90 and 120 seconds between requests.

The SynkLoader toolkit includes at least seven modules. System Profiler is a C# DLL for collecting system information. Persistence Module creates a scheduled task with a random name to launch SynkLoader at every user logon and every day at 10:00. PhishLocker displays a fake Windows lock screen to capture the user's logon password. TrafficRedirector is a backconnect or reverse proxy for reaching local network services or routing traffic through the infected machine. Interactive Shell is a RAT module for running PowerShell commands. StreamMaster is a VNC module for streaming the desktop and controlling mouse and keyboard. Finally, Status Checker is a Python script that reports the status of active modules.

Impact and possible links to ransomware or initial access brokers

WordlistLoader enables the execution of Amatera Stealer, which uses advanced evasion techniques to steal data and reduce artifacts on disk. SynkLoader can capture Windows credentials through the fake lock screen, establish persistence, run commands, control the desktop via VNC, and route traffic to the internal network. SynkLoader's final objectives are unclear, but Expel suspects the toolkit may belong to a ransomware group or an initial access broker. Both families are described as tools for delivering follow-on payloads or selling access. At this time, no associated CVEs have been identified, nor have any entries been added to CISA's KEV catalog.

Defenses and indicators of compromise

At this time, no official mitigations, workarounds, or vendor-specific detection guidance are available. While waiting for patches or guidelines, security teams can use the known indicators of compromise: the observed compromised domains (abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, www.caesarjaco.co[.]id, skybap[.]shop), the CDN cdn.jsdelivr[.]net, and the MSI URL on Azure Blob Storage (https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi). From a behavioral standpoint, it is advisable to monitor anomalous execution of conhost.exe, rundll32.exe, and mshta.exe, especially when accompanied by the use of remote WebDAV shares in suspicious command chains. For SynkLoader, detecting requests to hardcoded C2 domains or the appearance of random scheduled tasks can indicate an ongoing infection. User education about fake Teams help desks and requests to install software from unverified links remains a fundamental countermeasure.