A new malware loader has been discovered, using a clever trick to evade detection and deliver a growing infostealer. WordlistLoader, as it’s called, disguises malicious code by reconstructing it from ordinary English words. This allows Amatera, an increasingly prevalent infostealer, to sneak past security controls and infect victims.
Researchers at Gen Threat Labs have been tracking the spread of Amatera, which has become one of the most common infostealers in their user base over the past few months. Infostealers like Amatera are designed to steal sensitive information from compromised machines, including login credentials, software wallets, cryptocurrency wallets, and more.
WordlistLoader is a loader malware that serves as an intermediary between the initial infection and the final payload. Its primary job is to prepare the environment for the infostealer by evading security controls, reconstructing the next-stage payload, and handing off execution to Amatera. To achieve this, WordlistLoader uses a list of 256 ordinary English words that can be translated back into executable code prior to running it.
This trick allows WordlistLoader to evade detection, as malicious code is often identified by its unusual patterns and anomalies. By disguising itself as plain text, the malware loader can sneak past security controls and deliver Amatera undetected. According to Gen Threat Labs, WordlistLoader’s four key functions include reconstructing shellcode for subsequent stages, unhooking loaded modules, bypassing Event Tracing for Windows, and incorporating anti-emulation and anti-analysis tricks.
The use of ClickFix-style threat campaigns is also on the rise, with ClearFake clusters compromising legitimate websites to plant fake CAPTCHA lures. These social engineering attacks trick users into executing malicious commands, making it easier for Amatera and other malware to infect machines. If organizations aren’t already incorporating ClickFix into their security training, they should be.
The discovery of WordlistLoader highlights the ongoing cat-and-mouse game between threat actors and cybersecurity professionals. As defenders adapt to new evasion techniques, attackers will continue to find ways to stay one step ahead. To protect themselves from Amatera and other infostealers, users should remain vigilant when interacting with unfamiliar websites or clicking on suspicious links.
In practical terms, this means being cautious when receiving emails or messages that ask for sensitive information, and never executing code or downloading attachments from unknown sources. By staying informed about the latest threats and adopting best practices, individuals can significantly reduce their risk of falling victim to Amatera and other malware.
Source: Dark Reading — 2026-08-24