RESEARCHERS have identified a new malware loader dubbed WordlistLoader that distributes the Amatera infostealer through fake CAPTCHA prompts, a tactic labelled ClearFake. The campaign first appeared on 24 August 2026 and has been observed compromising Windows users who visit hijacked websites. Its significance lies in the loader’s ability to conceal malicious shellcode inside ordinary English words, letting it slip past many signature‑based defences.
WordlistLoader functions by taking a string of common words, converting each into a byte of shellcode and reconstructing the payload in memory. Once active it unhooks monitoring tools, disables Windows Event Tracing and employs various anti‑analysis tricks to hinder debugging. The loader then downloads and executes the Amatera stealer, which harvests credentials, browser data and cryptocurrency wallet information.
Infection begins when a victim encounters a counterfeit “I’m not a robot” CAPTCHA that instructs them to copy and run a PowerShell command. Executing the command triggers the loader’s word‑to‑shellcode routine, after which Amatera is deployed without any obvious file write‑activity. No CVEs have been assigned to this technique, highlighting its reliance on social engineering rather than software vulnerabilities.
The activity has been tracked from the initial sighting through to late evening on the same day, indicating a fast‑moving operation. Analysts note that the ClearFake lure has been used in earlier campaigns to spread other payloads, suggesting a mature distribution chain. Although no specific threat actor has been attributed, the focus on credential theft points to financially motivated groups seeking to monetise stolen data.
Defenders should treat any unexpected CAPTCHA that asks for command‑line execution as highly suspicious and block such interactions at the web‑gateway level. Enabling AMSI monitoring and restricting PowerShell to constrained language mode can prevent the loader’s reconstruction routine from succeeding. Endpoint solutions that detect anomalous memory allocations or unusual API calls related to unhooking should be tuned to alert on this behaviour.
Organisations are advised to update URL blocklists with domains known to host ClearFake lures and to share indicators of compromise with trusted ISACs. Regular user training that covers fake verification prompts reduces the chance of successful social engineering. By combining technical controls with awareness, the risk posed by WordlistLoader and its Amatera payload can be substantially lowered.