Reported by 2 outlets

Timeline

1. update from cyberpress.org

   WordlistLoader Hides Shellcode in Plain English Words to Deliver Amatera Stealer

   cyberpress.org · 54d ago · August 20th, 2026

   Security researchers have identified a new malware loader, dubbed WordlistLoader, used in ClearFake campaigns to deliver the Amatera Stealer. The loader hides malicious shellcode inside lists of ordinary English words, helping attackers make their payloads harder to detect. Recent ClearFake activity uses compromised legitimate websites to display fake CAPTCHA prompts . Visitors who click the “I’m not a robot” box are instructed to paste a copied command into the Windows Run dialog. This ClickFix technique causes the victim to execute a command that downloads WordlistLoader from a remote WebDAV share. The command uses conhost to launch a hidden Command Prompt process and rundll32 to execute the loader’s Run export. This delivery pattern resembles recent Amatera campaigns, but replaces earlier Python-based loaders with the new WordlistLoader component. WordlistLoader Conceals Amatera Shellcode WordlistLoader acts as an intermediate stage before Amatera is launched . Its main role is to rebuild shellcode hidden as a sequence of harmless-looking English words. The loader includes a build-specific list of 256 words. Each word maps to a single byte value based on its position in the list. For example, the first word represents byte 0x00 , while the word at position 144 represents 0x90 . Examples of compromised websites serving ClearFake’s FakeCaptchas (Source: gendigital) The malware reads each encoded word, finds its matching position in the wordlist, and writes that byte into a n

2. update from gbhackers.com

   ClearFake Fake CAPTCHA Campaigns Use New WordlistLoader to Deploy Amatera Stealer

   gbhackers.com · 54d ago · August 20th, 2026

   A new ClearFake infection chain using a previously undocumented intermediate payload dubbed WordlistLoader to deploy Amatera Stealer. The campaign combines compromised websites, fake CAPTCHA overlays, ClickFix social engineering, WebDAV-hosted DLLs and advanced anti-analysis mechanisms to deliver one of the more actively evolving information stealers currently tracked. Clicking the “I’m not a robot” control triggers a […] The post ClearFake Fake CAPTCHA Campaigns Use New WordlistLoader to Deploy Amatera Stealer appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from gbhackers.com

   Hackers Hide Malware Inside Plain English Words to Infect Windows Users With Amatera Stealer

   gbhackers.com · 48d ago · August 26th, 2026

   The loader disguises executable shellcode as sequences of ordinary English words, helping malware evade static inspection before reconstructing and launching the final payload in memory. Microsoft previously observed ACR Stealer operators using fake verification prompts, […] The post Hackers Hide Malware Inside Plain English Words to Infect Windows Users With Amatera Stealer appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   WordlistLoader Hides Malicious Shellcode in English Words to Deploy Amatera Stealer

   cyberpress.org · 48d ago · August 26th, 2026

   Gen Threat Labs has uncovered WordlistLoader, a new malware loader used in ClearFake campaigns to deliver the Amatera Stealer. Victims are told to prove they are human, but the process instead tricks them into copying and running a malicious command. After a victim clicks the checkbox, instructions tell them to paste copied text into the Windows Run dialog. The command launches a hidden process, connects to a remote WebDAV share, downloads a malicious DLL, and runs its exported “Run” function through rundll32. It first ensures only one copy runs on the device using a named event. It then attempts to weaken endpoint defenses by removing hooks from loaded Windows modules. The loader scans loaded modules and compares exported function instructions in memory with clean copies read from disk. If it detects jump instructions often used by security-product hooks, it restores the original bytes. This can help the malware avoid monitoring by antivirus or endpoint detection and response tools.