Published Aug 24, 2026, 8:35 AM ET · Updated 3 months ago · 1 source
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
The Hacker News
·
Original Report
Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha)