WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
- ID
- 17284
- Status
- summarized
- Published
- 24 Aug 2026, 8:35 PM
- Fetched
- 24 Aug 2026, 11:58 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.0
- Created
- 24 Aug 2026, 11:59 PM
- Tags
- Audience
- developerssaas_founders
What happened
Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, used to deliver stealers like Amatera and likely sell access to ransomware groups. WordlistLoader spreads via ClickFix (FakeCaptcha) social engineering on compromised websites, using fake CAPTCHA prompts to trick victims into pasting malicious commands into Windows Run. The campaign abuses jsDelivr CDN for staging and uses EtherHiding—blockchain smart contracts—to host and rotate malicious JavaScript payloads.
Why it matters
If your team uses jsDelivr as a CDN dependency, be aware threat actors are actively abusing it to host PowerShell payloads, though takedowns are reportedly fast. The ClickFix technique is now widespread enough that developers should educate non-technical colleagues not to paste commands from browser CAPTCHA prompts into Run dialogs. The EtherHiding approach (blockchain-hosted JS) makes blocking individual URLs ineffective since payloads can be swapped via smart contract.
Discussion angle
How the ClickFix/FakeCaptcha pattern exploits user trust in ubiquitous CAPTCHA flows, and whether teams using jsDelivr or similar CDNs should add integrity checks or alternative fallback sources for their dependencies.