CTI · corroborated · 2026-08-20

WordlistLoader Hides Shellcode in Plain English Words to Deliver Amatera Stealer

Full story & timeline

MITRE ATT&CK

• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1027 Obfuscated Files or Information Stealth
• T1055 Process Injection Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: WordlistLoader ClickFix Chain - conhost to Hidden cmd to WebDAV DLL Execution
id: fd8783f4-6c7f-4f04-a1b3-d3e21d169034
status: experimental
description: Detects the ClearFake/WordlistLoader infection chain where conhost.exe spawns a hidden cmd.exe that downloads a DLL from a WebDAV share and executes it via rundll32. The ClickFix technique tricks victims into pasting a command into the Run dialog that triggers this execution chain.
references:
  - https://cyberpress.org
  - https://gbhackers.com
author: Tia N. List
date: 2026-08-20
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059
  - attack.t1027
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_conhost_cmd:
    ParentImage|endswith: '\conhost.exe'
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
      - 'cmd'
      - '/c'
  selection_rundll32_webdav:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:
      - 'rundll32'
      - '\\'
      - '.dll'
    CommandLine|contains:
      - 'Run'
      - 'rundll32.exe'
  condition: selection_conhost_cmd or selection_rundll32_webdav
falsepositives:
  - Legitimate administrative scripts using conhost to launch hidden command prompts
  - Software installers that use rundll32 to load DLLs from network shares
level: high

References

• https://cyberpress.org
• https://gbhackers.com