ClearFake's New Loaders: WordlistLoader and SynkLoader
Two new Windows malware loaders, WordlistLoader and SynkLoader, are being analysed as part of the ClearFake campaign. WordlistLoader serves as the primary loader, pairing ClearFake with ClickFix-style social engineering to drop the Amatera stealer on compromised endpoints. The C2 channel for both loaders is EtherHiding, which stores and retrieves data on Ethereum smart contracts rather than relying on hardcoded domains or conventional web infrastructure.
How WordlistLoader Rebuilds Malware from Plain English
WordlistLoader packs four core functions into its payload, according to the Gen report. The first handles the main execution logic, the second manages the C2 handshake, the third is a built-in Microsoft logging function that hooks system activity for observation, and the fourth wraps the anti-analysis layer. The logging function is the one that makes the loader look like a standard Windows binary to security tools that inspect it in memory.
The anti-emulation and anti-analysis tricks sit in the fourth function. They cover the usual evasion set: a sleep hook to stall the loader in emulated environments, a process hollowing routine to hide the payload from the parent, and a few inline checks that flip the result when the loader detects a debugger or a known sandbox. Together they keep the payload out of plain sight in memory, which is the point of the wordlist-style structure — the payload is reconstructed from a flat list rather than unpacked from a single blob, so it doesn't sit in one contiguous buffer the way a typical loader would.
The ClearFake + ClickFix Delivery Chain
ClearFake compromises legitimate websites and injects JavaScript that serves a fake CAPTCHA prompt to visiting users. The lure is a ClickFix-style social engineering trick: the page instructs the victim to copy a command and paste it into the Windows Run dialog, which executes the payload directly on the endpoint. This is the same delivery pattern Proofpoint flagged a year ago, and it remains the primary initial-execution technique for the cluster.
The chain hands off to the Amatera stealer, which sweeps software wallets, cryptocurrency wallets, credentials, browser data, and message history from the compromised host. The C2 channel for both loaders is EtherHiding, which stores and retrieves data on Ethereum smart contracts instead of relying on hardcoded domains or conventional web infrastructure. That gives the campaign a persistent, takedown-resistant delivery path that resists the usual domain-sinkhole and IP-blacklist takedowns defenders typically apply against ClickFix campaigns.
EtherHiding C2 on Ethereum Smart Contracts
EtherHiding is the C2 channel that both loaders use to talk to the campaign. Instead of hardcoding a domain or IP in the payload, the malware queries an Ethereum smart contract to store, retrieve, or update C2 data on-chain. The contract acts as a persistent key-value store: the loader writes the C2 configuration, then reads it back during the handshake to validate the endpoint against the live contract state.
This replaces the conventional web infrastructure that most ClickFix campaigns rely on. The C2 lives on the blockchain, so defenders can't sinkhole the domain or blacklist the IP the way they would against a standard ClickFix delivery. Takedowns require either a contract upgrade or a full chain-level block, which is why the cluster has held the top spot on Red Canary's top 10 for four straight months.
Key points
- WordlistLoader and SynkLoader are two new Windows malware loaders in the ClearFake campaign.
- WordlistLoader uses ClearFake + ClickFix to drop Amatera stealer with EtherHiding C2 on Ethereum smart contracts.
- ClearFake compromises legitimate websites and plants fake CAPTCHA lures to trick users into executing malicious commands.
- Amatera stealer targets software wallets, crypto wallets, credentials, browser data, and message history.
- EtherHiding stores and retrieves C2 data via Ethereum smart contracts, replacing hardcoded domains or conventional web infrastructure.
Further reading & sources
- Foul Language: WordlistLoader Disguises Malware as Ordinary Text
- Intelligence Insights: June 2026 | Red Canary
- Intelligence Insights: August 2026 | Red Canary
- ClearFake Malware: Critical Crypto Stealer Attack
- 'Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites
- 【セキュリティレポート】ブロックチェーンを悪用する「ClearFake」テイクダウンを避けるほか、ブラックリストで排除されない仕組みで安定した配信経路を確保 - ZDNET Japan
- Hackers use Binance Smart Chain contracts to store malicious scripts