"Once the visitor clicks on the 'I'm not a robot' checkbox, they're walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it, leading to the download of WordlistLoader that ultimately results in the execution of Amatera," security researcher Vojtěch Krejsa said.
How ClickFix and WordlistLoader deliver Amatera
Security researchers at Gen Digital have linked a new intermediate loader called WordlistLoader to campaigns that deliver Amatera Stealer (also tracked as ACR Stealer or AcridRain Stealer) through so‑called ClearFake operations that rely on the ClickFix (aka FakeCaptcha) social-engineering flow. The ClickFix prompt appears as a standard CAPTCHA: victims click an "I'm not a robot" checkbox, are told to paste a command into the Windows Run dialog, and — if they follow instructions — execute a sequence that ultimately loads Amatera.
The ClickFix command chain documented in these incidents uses conhost to launch a hidden cmd.exe, maps a remote WebDAV share with pushd, and then invokes a loader through rundll32.exe. Gen Digital and Microsoft observed three recorded command variants: a direct rundll32 invocation; a pushd-mounted WebDAV share followed by rundll32.exe; and a headless, obfuscated pushd followed by rundll32.exe — the third of which aligns with the WordlistLoader chain.
EtherHiding, CDN abuse, and the compromised sites serving ClickFix
Rather than hosting their first-stage JavaScript directly, the adversaries inject a Base64-encoded blob into real websites; that blob fetches another JavaScript from a smart contract on the blockchain in an approach Gen Digital describes as EtherHiding. The retrieved code is executed dynamically, enabling operators to swap out burned URLs.
In recent months the ClearFake campaigns were also observed abusing a legitimate Content Delivery Network: "Although the CDN is meant for hosting JavaScript, the threat actors are actually using it to host their malicious PowerShell script," Expel noted earlier this January. The reported set of compromised sites that have served ClickFix prompts includes:
- abogadosrosarinos[.]com
- aptisweb[.]com
- avene-hebergement[.]com
- https-xhamster[.]com
- www.caesarjaco.co[.]id
- skybap[.]shop
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWordlistLoader's technical tricks and Amatera's updates
Gen Digital describes WordlistLoader as an intermediate component whose "primary purpose" is to reconstruct a shellcode entry point for follow-on stages. The loader encodes the shellcode as a sequence of plain English words, with each word representing one byte — the feature that gives WordlistLoader its name — and Gen Digital also observed a variant that uses an array of 16‑byte UUID‑encoded chunks instead.
To reduce observable traces, WordlistLoader uses a hardware-breakpoint-based method to bypass Event Tracing for Windows (ETW). The reconstructed shellcode then hands off to a reflective loader that unpacks and loads Amatera. Gen Digital notes overlap between this reflective loader and a late-April 2026 ClickFix campaign that delivered Amatera 4.3.3-alpha1.
The latest Amatera variant incorporates several low-level evasions and hardenings: "updated static obfuscation, hardened syscall invocation through the WoW64 transition, dynamically generated x64 indirect-syscall trampolines invoked through Heaven's Gate, and a redesigned application-bound encryption (ABE) bypass that appears to be directly inspired by Remus Stealer," Gen Digital reports. Microsoft also documented increased stealth in more advanced ClickFix variants: "In the more advanced variant, threat actors further enhance stealth by launching commands through conhost.exe –headless, suppressing visible console windows, and employing environment variable obfuscation with delayed variable expansion to conceal critical execution components such as pushd, rundll32, and the remote host name," Microsoft said. "Combined with minimized or headless execution, these techniques reduce user visibility, complicate static analysis and detection, and enable the infection chain to execute with minimal indication to the victim."
SynkLoader distributed via Microsoft Teams phishing
Separately, Expel identified SynkLoader being pushed through a Microsoft Teams phishing approach in mid‑August 2025 that aims to harvest Windows login credentials via a fake lock screen. Expel researcher Marcus Hutchins described the social engineering: "Someone using a <username>@<company>.onmicrosoft.com email (Microsoft 365's default email domain for companies) reached out to the target using the name IT Service Desk (<Fake Name>)." The impersonator convinced the victim to download an MSI from a Microsoft Azure file storage endpoint (https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi), which was presented as if it had come from Microsoft.
The MSI unpacks a ZIP and a PowerShell script; the PowerShell runs in memory, extracts the ZIP, and launches a Python-based loader that contacts one of three hard-coded command-and-control domains at random intervals. The loader decrypts and executes server responses and supports at least seven modules, including:
- System Profiler — a C# DLL that collects system data
- Persistence Module — a native DLL that creates a randomly named scheduled task to launch SynkLoader at logon and daily at 10 a.m.
- PhishLocker — a DLL that serves a fake Windows lock screen to capture the user's login password
- TrafficRedirector — a backconnect/reverse proxy for reaching internal services or routing traffic through the infected host
- Interactive Shell — a RAT module to execute PowerShell and return results
- StreamMaster — a VNC module to stream desktop and enable remote control
- Status Checker — a Python script reporting which modules are active
Expel said the operator's end goals are not certain: "It's not clear what the end goals of the operator are, but it's suspected that the toolkit may be part of a ransomware group or an initial access broker."
What this means for technologists, enterprises, and end users
Technologists and security teams should focus on three concrete signals in telemetry: WebDAV-mounted rundll32 loads invoked from headless conhost processes, evidence of in‑memory PowerShell fetched via CDN-hosted resources, and indicators tied to the WordlistLoader wordlist or UUID-encoded shellcode representations.
Enterprises and procurement leaders should note the abuse of Microsoft-branded channels and storage: the phishing vector used an onmicrosoft.com identity and an Azure blob URL to deliver an MSI that appeared to come from Microsoft, and SynkLoader's Persistence Module installs scheduled tasks with predictable daily behavior.
End users are the immediate targets of the ClickFix flow and the Teams bait: the reported campaigns rely on convincing prompts that ask victims to paste and run commands or to install an MSI presented as a vendor utility.
The combined reporting from Gen Digital, Expel, and Microsoft sketches a toolkit that mixes web compromise, blockchain-hosted scripts, CDN-hosted staging, WebDAV loading, and social-engineering inside collaboration platforms. The central unresolved question left in the reporting is operational: whether these toolkits will be sold as initial access to ransomware groups or wielded directly by the operators themselves.
