Wordlist Loader Delivers Amatera via Click Fix, Synk Loader Phishes Windows Passwords
Summary: Gen Digital researchers reported that WordlistLoader, a new malware family, delivers Amatera Stealer through ClearFake campaigns that use the ClickFix technique, in which compromised websites inject Base64-encoded JavaScript that fetches code from a blockchain smart contract via EtherHiding. A separate Expel and ReliaQuest analysis found SynkLoader distributed through Microsoft Teams phishing that impersonates an IT service desk and directs victims to install a fake 'PowerShell Cleaner' MSI from an Azure Blob Storage endpoint.
Why it matters: Both chains run through infrastructure security teams already trust - a legitimate CDN, Azure Blob Storage, and Microsoft Teams messages from an onmicrosoft.com address - so email, network, and sandbox controls see nothing unusual. SynkLoader's Python backdoor fetches its capabilities from a C2 server at runtime, meaning the toolkit a victim receives can change after detection.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026