WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Two new malware families, WordlistLoader and SynkLoader, have been identified by cybersecurity researchers as being used to distribute next-stage payloads and probably sell access to ransomware gangs.
WordlistLoader is being used to distribute Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) through ClearFake campaigns, which use the ClickFix (also known as FakeCaptcha) technique to trick victims into executing malicious commands under the guise of completing CAPTCHA verification checks, according to research from Gen Digital.
According to security researcher Vojtěch Krejsa, once the visitor selects the "I'm not a robot" checkbox, they are taken through the well-known ClickFix flow, in which a malicious command is copied into their clipboard and the victim is told to...