New WordlistLoader and SynkLoader Malware Families Detected
Security researchers have uncovered two new malware families that provide access to ransomware groups.
1WordlistLoader and SynkLoader Threats
Security researchers have identified two new malware families called WordlistLoader and SynkLoader. These malware are used to deliver next-stage payloads and likely sell access to ransomware groups. WordlistLoader distributes Amatera Stealer via ClearFake campaigns, while SynkLoader spreads through Microsoft Teams phishing campaigns.
2How the ClickFix Technique Works
The ClickFix technique tricks victims into running malicious commands under the pretext of completing CAPTCHA verification checks. When users click the 'I'm not a robot' checkbox, a malicious command is copied to their clipboard, and they are instructed to paste it into the Windows Run dialog. This leads to the download of WordlistLoader and the execution of Amatera.
3EtherHiding and CDN Abuse
ClickFix prompts are displayed on real websites compromised with malicious JavaScript. This JavaScript fetches another script from a smart contract stored on the blockchain and executes it dynamically. Recently, ClearFake campaigns have started using the legitimate CDN cdn.jsdelivr[.]net to host their malicious JavaScript.
4WebDAV-Based Loader
The ClickFix command uses 'conhost' to launch a hidden 'cmd.exe' process, maps a remote WebDAV share using pushd, and finally launches the loader via 'rundll32.exe'. This WebDAV-based approach overlaps with a similar campaign highlighted by Microsoft. Three different versions of the command have been recorded.
5Advanced Stealth Techniques
Threat actors enhance stealth by launching commands through conhost.exe --headless, suppressing visible console windows, and using environment variable obfuscation with delayed variable expansion to hide critical execution components. These techniques reduce user visibility and complicate static analysis.
6Unique Features of WordlistLoader
WordlistLoader stores shellcode in encoded form as a sequence of plain English words, with each word representing one byte. A variant replaces the wordlist with 16-byte UUID-encoded chunks. The shellcode uses a reflective loader responsible for unpacking and loading Amatera.
7SynkLoader's Phishing Campaign
SynkLoader is distributed via a Microsoft Teams phishing campaign that siphons victims' system login credentials by serving a fake lock screen. The target is contacted by a username using Microsoft 365's default email domain under the name IT Service Desk. The user downloads an MSI installer from a Microsoft Azure file storage endpoint.
8Cybersecurity Measures
These new malware families highlight the need for continuously updated cybersecurity measures. Users should avoid clicking links from unknown sources and report suspicious emails. Organizations should train employees against phishing attacks and keep security software up to date.