AI Weekly Malaysia

Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, used to deliver stealers like Amatera and likely sell access to ransomware groups. WordlistLoader spreads via ClickFix (FakeCaptcha) social engineering on compromised websites, using fake CAPTCHA prompts to trick victims into pasting malicious commands into Windows Run. The campaign abuses jsDelivr CDN for staging and uses EtherHiding—blockchain smart contracts—to host and rotate malicious JavaScript payloads.

Why: If your team uses jsDelivr as a CDN dependency, be aware threat actors are actively abusing it to host PowerShell payloads, though takedowns are reportedly fast. The ClickFix technique is now widespread enough that developers should educate non-technical colleagues not to paste commands from browser CAPTCHA prompts into Run dialogs. The EtherHiding approach (blockchain-hosted JS) makes blocking individual URLs ineffective since payloads can be swapped via smart contract.