Cyber attackers have found a new way to evade detection and deliver malware, using lists of ordinary English words to conceal malicious code. This tactic is being employed by a growing number of threat campaigns, including those that use ClickFix-style attacks to infect Windows machines with the increasingly prevalent infostealer Amatera.
Researchers from Gen Threat Labs discovered WordlistLoader, a loader used to prepare the environment for Amatera, a malware strain that has been in the wild for over a year and has become a popular choice among cyber attackers. As a loader, WordlistLoader exists between the initial infection and the final payload, allowing it to evade security controls, reconstruct the next-stage payload, and then hand execution off to Amatera.
WordlistLoader’s primary function is to rebuild shellcode that serves as the entry point for subsequent stages of the infection chain. It does this by including a series of plain English words that can be translated back into executable code prior to running it. This allows WordlistLoader to reconstruct hidden malicious code without arousing suspicion, making it more difficult for security tools to detect.
The mapping from English words to byte values is defined by a build-specific wordlist of 256 distinct words, which are stored as arrays of pointers. Rebuilding the shellcode comes down to iterating over the word sequence, looking up each word in the list, and writing the index of the matching entry into the output buffer. This process is complex enough that it would be difficult for human analysts to detect without sophisticated tools.
In addition to its ability to rebuild malicious code, WordlistLoader also includes several other features designed to evade detection. It can unhooks loaded modules, which are often used by security products to monitor system activity, and bypass Event Tracing for Windows, a built-in Microsoft logging function that assists security tools with observing system activity.
The threat campaigns using WordlistLoader are typically distributed via ClearFake campaigns, which compromise legitimate websites and plant fake CAPTCHA lures that use ClickFix-style social engineering to trick users into executing malicious commands. This tactic has become increasingly popular among cyber attackers in recent months, and organizations are advised to incorporate ClickFix into their security training.
The discovery of WordlistLoader highlights the ongoing cat-and-mouse game between cyber attackers and security researchers. As threat actors find new ways to evade detection, researchers must develop new tools and techniques to stay ahead. For now, it seems that the use of plain English words to conceal malicious code is a winning strategy for cyber attackers.
If you’re concerned about the risk of infection from WordlistLoader or Amatera, there are steps you can take to protect yourself. First and foremost, make sure your security software is up to date, including any monitoring tools that may be vulnerable to evasion techniques like those used by WordlistLoader. Additionally, be cautious when interacting with unfamiliar websites or clicking on links from unknown sources, as these tactics are often used in ClickFix-style attacks. By staying vigilant and taking proactive measures to protect yourself, you can reduce the risk of infection from this type of malware.
Source: Dark Reading — 2026-08-24