Loading story…
Researchers identified WordlistLoader as a new malware loader used in ClearFake campaigns to deliver Amatera Stealer (also tracked as ACR Stealer) through compromised legitimate websites. Victims are shown FakeCaptcha overlays and tricked into running clipboard-delivered commands that abuse conhost, cmd, WebDAV shares, and rundll32 to launch the loader. WordlistLoader then rebuilds shellcode from encoded English words or UUID fragments, unhooks modules, disables ETW logging with a hardware-breakpoint-based bypass, and executes shellcode that decrypts and reflectively loads Amatera. The campaign includes infrastructure such as command-and-control domains, dead-drop URLs, malware hashes, and compromised-site indicators.
The activity also reflects a broader trend of commodity stealers adopting advanced Windows evasion methods more often associated with higher-end malware. Amatera’s newer builds add stronger static obfuscation, stealthier WoW64 syscall invocation, and runtime-built x64 indirect syscall trampolines using Heaven’s Gate, a technique previously documented as a way to bypass user-mode hooks in the WoW64 subsystem. Its updated Chromium Application-Bound Encryption bypass also resembles methods seen in Remus and Lumma, underscoring how infostealer operators are rapidly incorporating sophisticated anti-detection and credential-theft capabilities into large-scale web-injection campaigns.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Gen published technical details on WordlistLoader's shellcode reconstruction, unhooking, and ETW bypass, along with Amatera evolution notes and indicators of compromise including hashes, C2 domains, dead-drop URLs, and compromised websites.
Gen Threat Labs identified WordlistLoader as a new loader used in ClearFake campaigns to deliver the Amatera stealer via FakeCaptcha lures on compromised legitimate websites.
Expel observed SynkLoader in a Microsoft Teams phishing campaign in which an actor posing as an IT Service Desk contact used a username@company.onmicrosoft.com account to lure a target into downloading an MSI from Azure Blob Storage. The Python-based loader deployed modules for profiling, persistence, credential theft, proxying, remote shell access, VNC control, and status reporting.
SafeBreach published its Pool Party research, stating it had responsibly disclosed the eight thread-pool injection techniques to Microsoft and affected EDR vendors and released supporting materials for defenders.
Mandiant published research explaining how malware can bypass WOW64 and user-mode inline hooks with Heaven's Gate, and proposed detection by correlating 32-bit and 64-bit syscall hooks.
SafeBreach's research on eight novel Windows thread-pool-based process injection techniques, dubbed Pool Party, was first presented at Black Hat Europe 2023.
According to Gen Threat Labs, Amatera version 4.1.0-alpha.1 introduced control-flow flattening and indirect control-flow obfuscation, and from this version onward used a revamped Chromium Application-Bound Encryption bypass resembling techniques associated with Remus and Lumma.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcegendigital.com
Open sourcesafebreach.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported that **ACRStealer** is running an active credential-theft operation through multiple delivery chains, including a compromised `.edu` WordPress site and a trojanized **Chris-PC RAM Booster** installer. The malware uses a four-stage infection flow that progresses from PowerShell or installer-based execution to Go and .NET loaders, then decrypts and injects shellcode in memory. Researchers said newer samples introduced a previously undocumented .NET loader, **CoreHubManager**, a new 16-byte XOR key, **AES-256-CBC** shellcode decryption, and **Heaven’s Gate** WoW64 transitions to run x64 code from a 32-bit process. Payloads were also signed with a stolen **ASUSTeK EV code-signing certificate**, allowing binaries such as `sunwukongs.exe` to better evade SmartScreen and other trust controls. Once installed, ACRStealer steals credentials, browser data, DPAPI-protected secrets, Windows Hello NGC keys, smart card certificates, Azure AD OAuth tokens, wallets, documents, and tokens from more than 200 applications, then exfiltrates the data over HTTPS. The malware also uses custom AFD socket operations and dead-drop resolvers hosted on **Steam**, **Google Docs/Slides**, and **Telegram** pages to retrieve command-and-control infrastructure. Breakglass mapped **17 C2 IPs** in the newer cluster and **9 live C2 servers** in the earlier campaign, with the larger set hosted by **VDSINA**, pointing to a concentrated infrastructure footprint. Researchers also found overlap with **SectopRAT**, **AmateraStealer**, **NetSupport RAT**, **OffLoader**, **HIjackLoader/IDATLoader**, and **ClickFix/FakeCAPTCHA** chains, and said ACRStealer has been rebranded as **AmateraStealer** and marketed as a malware-as-a-service offering.
Jun 29, 2026
Researchers reported an active campaign distributing **Amatera Stealer** by using fake “human verification”/CAPTCHA pages (often described as *ClickFix*) to trick users into manually pasting and running a command via the Windows **Run** dialog. Instead of launching PowerShell directly, the command abuses the signed Microsoft App-V script `SyncAppvPublishingServer.vbs` to proxy PowerShell execution through trusted Windows components (e.g., `wscript.exe`), helping the activity blend in with legitimate tooling and evade some defenses. On suitable targets—systems where **Application Virtualization (App-V)** is present and enabled (notably Windows 10/11 Enterprise/Education and modern Windows Server)—the infection chain performs anti-analysis checks to hinder sandbox detonation, then pulls staging/configuration data from a public **Google Calendar** (`.ics`) resource. Additional stages are retrieved using **steganography**, including encrypted payloads embedded in PNG images hosted on public infrastructure/CDNs, which are then decrypted and executed in memory to deliver Amatera (described as based on **ACR Stealer** and offered as **malware-as-a-service**). Recommended mitigations highlighted include tightening controls around Run-dialog execution, disabling unnecessary App-V components, increasing PowerShell/script logging visibility, and monitoring for anomalous outbound retrievals to calendar/image-hosting services.
Jun 29, 2026
Threat researchers reported separate malware campaigns that used fake or pirated software distribution channels to infect Windows users with credential theft and traffic-interception malware. In one campaign, attackers seeded cracked software sites with a trojanized `WinX_DVD_Copy_Pro.exe` that launched an obfuscated HTA through `MSHTA`, deployed an upgraded **CountLoader v3.2**, and ultimately delivered **ACR Stealer** entirely in memory. The loader established persistence with scheduled tasks, profiled infected hosts, authenticated to command-and-control with a JWT token, and supported additional payload delivery through ZIP, DLL, MSI, PowerShell, and removable-media propagation tasks. A second campaign abused interest in **DeepSeek-R1** by promoting a fake DeepSeek site through Google Ads and delivering a malicious installer, `AI_Launcher_1.21.exe`, backed by fake CAPTCHA pages, PowerShell, AES-decrypted payloads, and a domain-generation routine. The final malware, **BrowserVenom**, installed a rogue root certificate and reconfigured browsers to send traffic through the attacker-controlled proxy `141.105.130[.]106:37121`, allowing interception and collection of user web activity. Researchers said the operations relied on impersonation-themed infrastructure and low-detection payloads to evade defenses, with BrowserVenom infections observed in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
Aug 14, 2026