Dangerous New Loaders Emerge: Cybersecurity Researchers Uncover WordlistLoader and SynkLoader Deploying Advanced Stealers and RaaS Precursors

Executive Overview

The threat landscape is rapidly shifting toward Living-off-the-Land (LotL) tactics, stealthy execution chains, and advanced evasion protocols. While WordlistLoader is predominantly spread through widespread "ClickFix" social engineering campaigns that exploit legitimate infrastructure like WebDAV shares and content delivery networks (CDNs), SynkLoader leverages targeted Microsoft Teams phishing lures to deploy deceptive system lock screens designed to harvest enterprise login credentials.

Together, these campaigns demonstrate a worrying evolution in cybercriminal efficiency. Threat actors are continuously refining their techniques to minimize on-disk artifacts, evade Event Tracing for Windows (ETW), exploit blockchain-backed smart contracts, and bypass modern browser protections like application-bound encryption (ABE). As organizations struggle to keep pace with these multi-layered attacks, security teams must understand the complete infection lifecycles, advanced evasion mechanics, and operational signatures of both WordlistLoader and SynkLoader.

Detailed Chronology of the Threat Campaigns

The WordlistLoader and Amatera Infostealer Lifecycle

The genesis of the WordlistLoader threat vector can be traced through its integration with the notorious ClearFake campaigns. Security analytics from Gen Digital have revealed a carefully orchestrated, multi-step infection chain that begins when an unsuspecting user navigates to a legitimately compromised website.

1. Compromised Infrastructure and EtherHiding: Threat actors inject malicious Base64-encoded JavaScript blobs directly into real, high-traffic websites. Rather than hosting the secondary scripts on malicious or rogue servers, the injected code queries smart contracts stored on public blockchains—a technique known as "EtherHiding." This decentralized approach ensures that even if traditional command-and-control (C2) domains or hosting sites are seized or blocked, the campaign can instantly pivot to fresh operational endpoints.
2. The ClickFix Social Engineering Vector: Once the page loads, visitors are confronted with a fake or stylized browser prompt—frequently masquerading as a routine CAPTCHA verification check (often termed "ClickFix" or "FakeCaptcha"). When the user clicks the "I’m not a robot" checkbox, a malicious script silently copies a complex PowerShell command directly into the user’s system clipboard.
3. Execution via Windows Run Dialog: The victim is then socially engineered to open the Windows Run dialog box (Win + R), paste the clipboard contents, and execute the payload.
4. Obfuscated Process Launch: The executed command initializes a hidden or headless instance of conhost.exe to suppress visible console windows, subsequently invoking cmd.exe. In more advanced variants documented by Microsoft, actors utilize delayed variable expansion and environment variable obfuscation to hide crucial execution flags, including pushd, rundll32, and the remote host address.
5. WebDAV and Remote Payload Retrieval: The command maps a remote WebDAV share over HTTPS, utilizing rundll32.exe to fetch a remote Dynamic Link Library (DLL) or loader component from an external server.
6. WordlistLoader Reconstruction and ETW Evasion: Upon execution, WordlistLoader’s primary mission is to reconstruct raw shellcode in memory. Intriguingly, the malware gets its moniker from the fact that this shellcode is stored in an encoded format as a sequence of plain English words, where each individual word corresponds to a single byte (thoughuuid-encoded variations have also been documented). To avoid detection by security monitoring tools, WordlistLoader employs a hardware-breakpoint-based methodology designed specifically to blind Event Tracing for Windows (ETW) and eliminate local execution traces.
7. Reflective Loading of Amatera 4.3.3-alpha1: A reflective loader unpacks and maps the final payload into memory: Amatera Stealer. This latest iteration of the stealer features hardened syscall invocations via the WoW64 transition, dynamically generated x64 indirect-syscall trampolines invoked through Heaven’s Gate, and a sophisticated ABE bypass inspired by Remus Stealer.

The SynkLoader Microsoft Teams Phishing Vector

While WordlistLoader focuses on browser-based drive-by social engineering, SynkLoader relies heavily on direct human interaction and trusted collaboration platforms. Detected by Expel researchers in mid-August 2025, SynkLoader campaigns have weaponized Microsoft Teams communication channels to infiltrate enterprise environments.

1. Initial Outreach via Compromised Tenancy: Threat actors utilize compromised Microsoft 365 enterprise tenant accounts (formatted typically as <username>@<company>.onmicrosoft.com) to initiate conversations with target employees. Impersonating internal support, the actors adopt display names such as "IT Service Desk."
2. Social Engineering and MSI Deployment: The bogus IT personnel convince the target to download and execute a malicious Microsoft Installer (.msi) file hosted on legitimate Microsoft Azure blob storage endpoints (such as filereserve.blob.core.windows[.]net). By hosting payloads on trusted cloud storage providers, the files easily bypass basic perimeter filtering and inherit an appearance of official corporate software.
3. PowerShell Cleaner Disguise: The installer masquerades as a routine enterprise utility—a "PowerShell Cleaner." Upon execution, it silently extracts a ZIP archive alongside a PowerShell script designed to run entirely in memory.
4. Python-Based Modular Framework: The script deploys a Python-based loader. This loader selects among multiple hard-coded command-and-control domains, checking in intermittently while incorporating randomized sleep intervals (ranging from 90 to 120 seconds) to blend in with legitimate network telemetry.
5. Modular Functionality: The C2 server responds with encrypted instructions that map to at least seven distinct operational modules, granting operators broad visibility, credential-harvesting capabilities, and lateral movement options within the infected network.

Supporting Context & Technical Metrics

To fully appreciate the severity of these campaigns, security architects must examine the underlying mechanics, environmental impacts, and technical indicators associated with both loaders.

Comparative Technical Breakdown

The Abuse of Legitimate Infrastructure

A prominent hallmark of modern cybercrime highlighted by these discoveries is the systematic abuse of trusted utility platforms. In the WordlistLoader campaigns, threat actors shifted toward hosting malicious PowerShell and JavaScript files on cdn.jsdelivr[.]net. Because legitimate web developers and software vendors rely heavily on jsDelivr to host open-source libraries, security filters and corporate firewalls routinely whitelist traffic to and from the network. While platform maintainers work quickly to ban offending repositories, the integration of EtherHiding ensures that threat actors can instantly swap compromised URLs without losing overall campaign momentum.

Similarly, SynkLoader operators leverage Microsoft Azure blob storage endpoints. By storing their malicious .msi packages on Microsoft’s own cloud infrastructure, the download URLs feature trusted domains that bypass automated reputation checks and disarm the user’s intuitive caution.

Official Statements and Industry Insights

The discovery of these loaders has prompted extensive analysis and commentary across the cybersecurity community, highlighting the systemic shift toward evasive loader architectures.

"Once the visitor clicks on the ‘I’m not a robot’ checkbox, they’re walked through the well-known ClickFix flow, where a malicious command is copied into their clipboard and the victim is instructed to paste it into the Windows Run dialog and execute it, leading to the download of WordlistLoader that ultimately results in the execution of Amatera."
— Vojtěch Krejsa, Security Researcher at Gen Digital

Security analysts at Microsoft have likewise emphasized the growing complexity of these execution chains, noting the deliberate steps taken by modern threat actors to obscure their activities from endpoint detection and response (EDR) platforms:

"In the more advanced variant, threat actors further enhance stealth by launching commands through conhost.exe –headless, suppressing visible console windows, and employing environment variable obfuscation with delayed variable expansion to conceal critical execution components such as pushd, rundll32, and the remote host name. Combined with minimized or headless execution, these techniques reduce user visibility, complicate static analysis and detection, and enable the infection chain to execute with minimal indication to the victim."
— Microsoft Threat Intelligence

Furthermore, researchers focusing on the human-targeted elements of SynkLoader have drawn attention to the psychological manipulation inherent in modern social engineering attacks:

"The IT service desk convinced the user to download and install an MSI installer from a Microsoft Azure file storage endpoint… which gave the file the appearance of having come from Microsoft."
— Marcus Hutchins, Security Researcher at Expel

Future Outlook and Strategic Recommendations

The dual emergence of WordlistLoader and SynkLoader illustrates a maturing cybercrime economy where specialized developers build sophisticated, modular loading mechanisms and lease them out to downstream operators, initial access brokers, and ransomware affiliates. As these toolkits grow increasingly resilient against traditional telemetry and analysis, traditional security perimeters are no longer sufficient.

Defensive Recommendations for Enterprise Security Teams

1. Harden Endpoint Scripting and Run Dialogs: Organizations should implement strict application control policies (such as AppLocker or Windows Defender Application Control) to block unauthorized executions originating from the Windows Run dialog, WebDAV shares, and temporary directories. Disabling or restricting the usage of WebDAV clients where unnecessary can severely disrupt remote DLL loading techniques.
2. Monitor Collaborative Platforms: Given the rise of attacks leveraging platforms like Microsoft Teams (such as SynkLoader) and SharePoint, security teams must extend monitoring and threat-hunting capabilities beyond email gateways. Implement strict inspection policies for external tenant communications and educate employees on verifying out-of-band identity when dealing with internal IT requests.
3. Combat Living-off-the-Land (LotL) Tactics: Security operations centers (SOCs) should tune their SIEM and EDR tools to look for anomalous behaviors involving administrative utilities—such as headless executions of conhost.exe, unexpected invocations of rundll32.exe interacting with external IPs or WebDAV paths, and the use of delayed variable expansion in command-line arguments.
4. Assume Breach and Enforce Zero Trust: Because loaders like Amatera are specifically designed to bypass browser-based application-bound encryption (ABE) and harvest active session cookies, organizations must deploy robust Identity and Access Management (IAM) controls, enforce phishing-resistant Multi-Factor Authentication (MFA), and implement continuous session monitoring to thwart account takeover attempts.