[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuljHd243Dmo7uOwt07R8U0MzsSdZyHoMnZsspu6CCCI":3,"$fBZDE8HVP4OEEWllN8Aa243110BJmGNnLsK6BZBV89Zg":62},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":59,"created_at":60,"updated_at":61,"published_at":24},"clearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum","ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum","Two new Windows loaders use ClearFake + ClickFix to deploy Amatera with EtherHiding C2 on Ethereum smart contracts.","ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.",[10,11,12,13,14,15],"ClearFake","WordlistLoader","SynkLoader","Amatera","EtherHiding","ClickFix","# ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum\n\n*Two new Windows loaders use ClearFake + ClickFix to deploy Amatera with EtherHiding C2 on Ethereum smart contracts.*\n\n**Tags:** `ClearFake` `WordlistLoader` `SynkLoader` `Amatera` `EtherHiding` `ClickFix`\n\n> ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.\n\n---\n\n## ClearFake's New Loaders: WordlistLoader and SynkLoader\n\nTwo new Windows malware loaders, WordlistLoader and SynkLoader, are being analysed as part of the ClearFake campaign. WordlistLoader serves as the primary loader, pairing ClearFake with ClickFix-style social engineering to drop the Amatera stealer on compromised endpoints. The C2 channel for both loaders is EtherHiding, which stores and retrieves data on Ethereum smart contracts rather than relying on hardcoded domains or conventional web infrastructure.\n\n## How WordlistLoader Rebuilds Malware from Plain English\n\nWordlistLoader packs four core functions into its payload, according to the Gen report. The first handles the main execution logic, the second manages the C2 handshake, the third is a built-in Microsoft logging function that hooks system activity for observation, and the fourth wraps the anti-analysis layer. The logging function is the one that makes the loader look like a standard Windows binary to security tools that inspect it in memory.\n\nThe anti-emulation and anti-analysis tricks sit in the fourth function. They cover the usual evasion set: a sleep hook to stall the loader in emulated environments, a process hollowing routine to hide the payload from the parent, and a few inline checks that flip the result when the loader detects a debugger or a known sandbox. Together they keep the payload out of plain sight in memory, which is the point of the wordlist-style structure — the payload is reconstructed from a flat list rather than unpacked from a single blob, so it doesn't sit in one contiguous buffer the way a typical loader would.\n\n## The ClearFake + ClickFix Delivery Chain\n\nClearFake compromises legitimate websites and injects JavaScript that serves a fake CAPTCHA prompt to visiting users. The lure is a ClickFix-style social engineering trick: the page instructs the victim to copy a command and paste it into the Windows Run dialog, which executes the payload directly on the endpoint. This is the same delivery pattern Proofpoint flagged a year ago, and it remains the primary initial-execution technique for the cluster.\n\nThe chain hands off to the Amatera stealer, which sweeps software wallets, cryptocurrency wallets, credentials, browser data, and message history from the compromised host. The C2 channel for both loaders is EtherHiding, which stores and retrieves data on Ethereum smart contracts instead of relying on hardcoded domains or conventional web infrastructure. That gives the campaign a persistent, takedown-resistant delivery path that resists the usual domain-sinkhole and IP-blacklist takedowns defenders typically apply against ClickFix campaigns.\n\n## EtherHiding C2 on Ethereum Smart Contracts\n\nEtherHiding is the C2 channel that both loaders use to talk to the campaign. Instead of hardcoding a domain or IP in the payload, the malware queries an Ethereum smart contract to store, retrieve, or update C2 data on-chain. The contract acts as a persistent key-value store: the loader writes the C2 configuration, then reads it back during the handshake to validate the endpoint against the live contract state.\n\nThis replaces the conventional web infrastructure that most ClickFix campaigns rely on. The C2 lives on the blockchain, so defenders can't sinkhole the domain or blacklist the IP the way they would against a standard ClickFix delivery. Takedowns require either a contract upgrade or a full chain-level block, which is why the cluster has held the top spot on Red Canary's top 10 for four straight months.\n\n## Key points\n\n- WordlistLoader and SynkLoader are two new Windows malware loaders in the ClearFake campaign.\n- WordlistLoader uses ClearFake + ClickFix to drop Amatera stealer with EtherHiding C2 on Ethereum smart contracts.\n- ClearFake compromises legitimate websites and plants fake CAPTCHA lures to trick users into executing malicious commands.\n- Amatera stealer targets software wallets, crypto wallets, credentials, browser data, and message history.\n- EtherHiding stores and retrieves C2 data via Ethereum smart contracts, replacing hardcoded domains or conventional web infrastructure.\n\n## Further reading & sources\n\n- [Foul Language: WordlistLoader Disguises Malware as Ordinary Text](https:\u002F\u002Fwww.darkreading.com\u002Fdata-privacy\u002Fwordlistloader-disguises-malware-ordinary-text)\n- [Intelligence Insights: June 2026 | Red Canary](https:\u002F\u002Fredcanary.com\u002Fblog\u002Fthreat-intelligence\u002Fintelligence-insights-june-2026)\n- [Intelligence Insights: August 2026 | Red Canary](https:\u002F\u002Fredcanary.com\u002Fblog\u002Fthreat-intelligence\u002Fintelligence-insights-august-2026)\n- [ClearFake Malware: Critical Crypto Stealer Attack](https:\u002F\u002Fblog.cybernexora.com\u002Fclearfake-malware)\n- ['Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites](https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fetherhiding-blockchain-technique-hides-malicious-code-wordpress-sites)\n- [【セキュリティレポート】ブロックチェーンを悪用する「ClearFake」テイクダウンを避けるほか、ブラックリストで排除されない仕組みで安定した配信経路を確保 - ZDNET Japan](https:\u002F\u002Fjapan.zdnet.com\u002Frelease\u002F30919928\u002F)\n- [Hackers use Binance Smart Chain contracts to store malicious scripts](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-use-binance-smart-chain-contracts-to-store-malicious-scripts\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fclearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum.png?v=9ddcd54bf4",{"actors":19,"malware":26,"targets":31,"timeline":36,"technologies":41},[20],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Fclearfake","clearfake","unknown",null,"financial",[27,28,29,30],{"name":11},{"name":13},{"name":14},{"name":10},[32],{"name":33,"sector":34,"status":35,"geography":24},"WordPress","CMS","confirmed",[37],{"date":38,"event":39,"description":40},"2025-08","Top10 leave","Atomic Stealer leaves top 10",[42,45,47,50,52,54,56,58],{"vendor":43,"product":44},"Microsoft","Event Tracing for Windows",{"vendor":43,"product":46},"Windows",{"vendor":48,"product":49},"Binance","Smart Chain (BSC)",{"vendor":43,"product":51},"Entra ID",{"vendor":43,"product":53},"Microsoft 365",{"vendor":43,"product":55},"Windows Hello for Business",{"vendor":48,"product":57},"Binance Smart Chain (BSC)",{"vendor":33,"product":33},"campaign","2026-09-25T07:08:58.057093+00:00","2026-10-16T12:28:09.513909+00:00",{"articles":63},[64,75,86,98],{"slug":65,"title":66,"summary":67,"tags":68,"hero_image_url":72,"story_type":73,"created_at":74},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[69,15,11,12,70,71],"Gen Digital","infostealer","ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","threat_actor_activity","2026-09-25T12:05:45.613962+00:00",{"slug":76,"title":77,"summary":78,"tags":79,"hero_image_url":84,"story_type":59,"created_at":85},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[80,81,82,83,70],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","2026-09-30T07:09:51.117027+00:00",{"slug":87,"title":88,"summary":89,"tags":90,"hero_image_url":96,"story_type":59,"created_at":97},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.",[91,92,93,94,95],"UNC6671","vishing","extortion","BlackFile","DLS","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b","2026-09-22T07:04:26.729885+00:00",{"slug":99,"title":100,"summary":101,"tags":102,"hero_image_url":108,"story_type":59,"created_at":109},"dr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave","Dr.Web Q2 2026: +5.72% detections, +95.32% unique threats, MAX-messenger phishing wave","Dr.Web's Q2 2026 virus activity review reports a 5.72% increase in total detections and a 95.32% jump in unique threats, with encoder trojans and a MAX-messenger phishing campaign driving the top of the mix.",[103,104,105,106,107],"Dr.Web","Q2 2026","encoder trojans","MAX-messenger","phishing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdr-web-q2-2026-5-72-detections-95-32-unique-threats-max-messenger-phishing-wave.png?v=206efdb9fc","2026-09-20T12:05:24.111918+00:00"]