Two Campaigns, Same Dependency: Writing Payloads to Disk
Gen Digital and Expel recently flagged two new malware families making the rounds. WordlistLoader delivers Amatera stealer via fake CAPTCHA prompts on compromised websites, and SynkLoader arrives via Microsoft Teams phishing disguised as IT support. Both campaigns are well-executed social engineering, and both are being used to sell access to ransomware groups.
The WordlistLoader campaign uses ClickFix (also called FakeCaptcha) — visitors to compromised websites see a fake CAPTCHA prompt, click “I’m not a robot,” and are walked through copying a malicious command into the Windows Run dialog. The command uses conhost to launch a hidden cmd.exe process, mounts a remote WebDAV share via pushd, and invokes rundll32.exe to load a malicious DLL from the share. The DLL is WordlistLoader, which reconstructs shellcode stored as plain English words (one byte per word) and ultimately unpacks Amatera stealer version 4.3.3-alpha1.
The SynkLoader campaign is more direct. An attacker impersonates IT support via Microsoft Teams, convinces the victim to download an MSI installer from Azure blob storage, and the victim runs it thinking it’s a legitimate “PowerShell Cleaner” tool. The MSI extracts a ZIP archive and a PowerShell script, which launches a Python-based loader. The loader checks in with one of three hard-coded command-and-control domains and downloads modules on demand: a system profiler, a persistence mechanism via scheduled task, a fake Windows lock screen to phish the user’s login password, a reverse proxy, a remote shell, a VNC module, and a status checker.
Both campaigns involve sophisticated obfuscation. The WordlistLoader command uses environment variable obfuscation with delayed variable expansion, headless execution to suppress console windows, and the loader itself employs hardware-breakpoint-based ETW bypass. Amatera stealer uses syscall invocation through WoW64 transition, dynamically generated x64 indirect-syscall trampolines via Heaven’s Gate, and an application-bound encryption bypass inspired by Remus Stealer. SynkLoader’s modules are delivered on demand and decrypted in memory.
All of that becomes irrelevant if the payload never lands on disk.
The Upstream Intervention: Block the Write, Stop the Chain
Both infection chains depend on writing executable code to the Windows file system before anything else can happen. WordlistLoader’s DLL has to be written locally (even if it’s loaded from a remote WebDAV share, rundll32.exe caches it) before it can reconstruct shellcode and unpack the stealer. SynkLoader’s MSI has to extract a ZIP archive and Python scripts before the loader can run and download modules.
FileSure Defend operates at the Windows kernel level via a filter driver and intercepts every file write operation before it completes. A rule that blocks unauthorized programs from writing executable files stops both campaigns at the delivery stage — before the DLL lands, before the MSI extracts, before the stealer or credential phisher ever executes.
Here’s a specific FileSure rule configuration that would have blocked both campaigns:
File name filter: *.dll, *.exe, *.msi, *.py, *.vbs, *.ps1
Program name filter: Exclude authorized deployment tools (SCCM, your RMM agent, etc.)
Operations: Create, Write
Drive type: Hard drives, Network drives
Result: Block and log
When the victim runs the ClickFix command and rundll32.exe attempts to load the DLL from the WebDAV share, the file write is intercepted and blocked. The DLL never lands. WordlistLoader never runs. Amatera never unpacks.
When the victim runs the SynkLoader MSI installer, the extraction of the ZIP archive and Python scripts is intercepted and blocked. The loader never lands. The modules never download. The fake lock screen never appears.
The scumbags can obfuscate the delivery command all they want. They can use conhost headless execution, environment variable tricks, and smart contracts on the blockchain to stage payloads. If the payload can’t write to disk, none of the subsequent stages matter. The stealer never steals. The credential phisher never phishes. The ransomware group never gets access.
Why Signature-Based Tools Miss This
Both campaigns would likely evade signature-based detection for hours or days after they first appeared. WordlistLoader stores its shellcode as plain English words — one byte per word — which makes static analysis difficult. Amatera 4.3.3-alpha1 includes updated obfuscation and syscall techniques specifically designed to evade EDR. SynkLoader’s modules are delivered on demand and decrypted in memory, leaving minimal on-disk artifacts.
FileSure doesn’t try to recognize the threat. It simply controls what’s allowed to happen to your files. A rule that blocks unauthorized programs from writing executable files works the same way on a brand-new malware variant as it does on one from five years ago. No signature update required. No waiting for your vendor to catch up.
The article mentions that WordlistLoader campaigns have been observed between late April 2026 and mid-June 2026, and SynkLoader was detected in mid-August 2025. If you’re reading about it now, the attack already happened to someone else. The question is whether your environment is protected against the variant that shows up tomorrow morning — the one nobody has seen yet.
Start a free 21-day trial at bystorm.com. Install FileSure, open a Word document, and you’ll see exactly what we mean.
Source: WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Category: Ransomware
Tags: wordlistloader, synkloader, amatera stealer, clickfix, kernel filter driver, file system security, zero-day defense, initial access broker
