New Malware Loaders Target Windows Users via ClickFix and Teams

Security researchers have documented two new Windows malware loaders, WordlistLoader and SynkLoader, that use fake CAPTCHA pages and Microsoft Teams phishing to deliver an information stealer and capture login passwords. Gen Digital reported that WordlistLoader is being used in ClearFake campaigns to install Amatera Stealer, also tracked as ACR Stealer or AcridRain Stealer, through the ClickFix technique. In a ClickFix attack, a site shows a convincing "I'm not a robot" checkbox; after a visitor clicks it, a malicious command is copied to the clipboard and the victim is told to paste it into the Windows Run dialog and execute it. That command downloads WordlistLoader and eventually runs Amatera, according to security researcher Vojtěch Krejsa.

The ClickFix prompts are injected into real websites that attackers have already compromised. The malicious JavaScript is added as a Base64-encoded blob (Base64 is a text encoding that can hide the real code). That blob contacts a smart contract stored on a blockchain to fetch another piece of JavaScript and run it, a technique the researchers call EtherHiding, because the malicious code is hidden on the blockchain. Some compromised sites observed serving these prompts included abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, www.caesarjaco.co[.]id, and skybap[.]shop. In recent months, ClearFake campaigns have also abused the legitimate content delivery network cdn.jsdelivr.net to host the attacker's malicious JavaScript and PowerShell script. Expel noted that jsDelivr tends to remove the actor's repositories quickly, but EtherHiding lets the attackers change burned URLs for fresh working ones. The ClickFix command itself is designed for stealth: it launches a hidden cmd.exe process through conhost, maps a remote WebDAV share (a network file share) with pushd, and then starts the loader with rundll32.exe (a legitimate Windows tool for running code from a library file). Microsoft has separately described the same WebDAV approach in three recorded command forms: a direct rundll32 invocation, a pushd-mounted WebDAV share followed by rundll32.exe, and a headless obfuscated pushd execution followed by rundll32.exe, the last matching the WordlistLoader infection chain. In the advanced variant, the command uses conhost.exe --headless to hide console windows and uses environment variable obfuscation with delayed variable expansion to conceal pushd, rundll32, and the remote host name.

WordlistLoader is an intermediate stage in the Amatera infection chain. Its main job is to reconstruct shellcode, raw machine code that serves as the entry point for later stages. Gen Digital said the loader uses a hardware-breakpoint-based method to bypass Event Tracing for Windows (ETW), a built-in Windows logging system, so it leaves fewer traces. The malware family gets its name because the shellcode is stored as a sequence of plain English words, with each word standing for one byte. Gen also found a variant that stores the shellcode as an array of 16-byte UUID-encoded chunks (long random identifiers). The reconstructed shellcode then passes control to a reflective loader, a technique that loads a program directly in memory without writing it to disk, and that reflective loader unpacks and loads Amatera 4.3.3-alpha1. The same reflective loader was seen in late April 2026 in another ClickFix campaign. Earlier in 2026, researchers observed Python-based loaders delivering ACR Stealer, but those have now been replaced by WordlistLoader. ACR Stealer has also been pushed through ClickFix prompts that trigger MSHTA, the Windows HTML application host, to fetch and run remote HTA content, leading to a VBScript loader that decodes PowerShell and fetches a JPEG image from an image-hosting service to extract the stealer payload in memory. The latest Amatera version adds updated static obfuscation, hardened syscall invocation through the WoW64 transition (the Windows subsystem that lets 32-bit programs run on 64-bit Windows), dynamically generated x64 indirect-syscall trampolines invoked through Heaven's Gate (a technique for switching between 32-bit and 64-bit code), and a redesigned application-bound encryption bypass inspired by Remus Stealer.

Separately, Expel detected SynkLoader in a Microsoft Teams phishing campaign in mid-August 2025. An attacker using a Microsoft 365 onmicrosoft.com email address and the display name "IT Service Desk" contacted a target and convinced them to download and install an MSI installer (a Microsoft installer package) from an Azure file storage endpoint (filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi). The installer presented itself as a PowerShell Cleaner, and because the file came from a Microsoft Azure blob storage URL (Microsoft's cloud file storage) it looked as though it had come from Microsoft. Once run, the MSI extracted a ZIP archive and a PowerShell script; the script was executed in memory and launched a Python-based loader. That loader chooses one of three hard-coded command-and-control (C2) domains (servers that attackers use to send instructions to infected computers) at random, checks in with the server, and sleeps for 90 to 120 seconds between requests before decrypting and running whatever the server returns. Expel identified at least seven modules: a System Profiler written in C# that collects information about the machine; a Persistence Module that creates a randomly named scheduled task to launch SynkLoader at each login and daily at 10 a.m.; PhishLocker, which shows a fake Windows lock screen to steal the user's password; TrafficRedirector, a reverse proxy that gives the attacker access to local network services; an Interactive Shell remote access trojan (RAT) for running PowerShell commands; StreamMaster, a Virtual Network Computing (VNC) module for streaming the victim's desktop and controlling the mouse and keyboard; and a Status Checker script that reports which modules are active. Expel researcher Marcus Hutchins described the initial contact. It is not yet clear what the operator's final goal is, but Expel suspects the toolkit may belong to a ransomware group or an initial access broker, a criminal who breaks into networks and sells that access to others.

In a follow-up shared after the original publication, updated on August 26, 2026, ReliaQuest said it observed the same SynkLoader PowerShell loader spread through vishing (voice phishing, phone calls that trick people) and Microsoft Teams messages impersonating IT support staff. The delivery chains still lead victims to a fraudulent "PowerShell Cleaner" MSI hosted on legitimate Azure Blob Storage, mirroring Expel's findings. ReliaQuest added that SynkLoader decrypts its payload in memory and checks a cryptographic hash before running it; if the payload has been changed or extracted incorrectly, the loader fails silently instead of continuing. The loader has also been observed deploying a modular Python