An invitation comes through from the company IT help desk. The message invites you to download a utility for cleaning up your machine; the URL takes you to Microsoft’s Azure network. There’s nothing strange about the invitation at all. A few minutes later, an exact replica of the Windows 11 lock screen screen quietly collects your password from you.
What is WordlistLoader? WordlistLoader is a malware loader that uses an array of English words as its shellcode, one word for one byte of code. This malware spreads using fake CAPTCHA invitations and downloads the infostealer Amatera.
How WordlistLoader Hides Code In Plain English
WordlistLoader includes its payload in clear text form. Each variant contains 256 English words, each of which is translated into a single byte. Byte 0x00 corresponds to position 0, while the 144th word equals 0x90, the instruction meaning “nop” on the x86 platform.
String scanning tools will see vocabulary rather than code when analyzing the file. The bytes only form an executable payload at runtime.
The operators have previously encoded the payload using this method twice. The other version replaces the wordlist with the same payload stored in the form of 16-byte UUIDs decoded by the Windows UuidFromStringA function. Changing the format gives practically no additional expenses for the attacker and makes existing detection rules useless.
The loader tries to operate in stealth mode even during the execution. It checks for any other copies of itself and resets the original code of modules modified by protection products. Also, it disables the Windows event tracing by redirecting calls to ntdll!NtTraceEvent to the code returning always 0.
One Pasted Command Opens The Door
Delivery is initiated via legitimate sites containing the injected JavaScript. The following phase is downloaded from a blockchain smart contract storage method that does not leave a take-down-able server anywhere. It creates a false CAPTCHA on top of the website.
A user clicking on the “I’m not a robot” button does nothing it simply copies a code to their clipboard, after which they are prompted to paste the code into their Windows Run dialogue. Nothing executes until the code is actually pasted by the target. The use of this method, ClickFix, grew by 517% in the first half of 2025 and thus became the second most popular attack vector after standard phishing attacks.
The code that gets executed is a small sequence of trusted Windows programs, conhost starts a hidden console prompt, pushd mounts a WebDAV share via HTTPS, and rundll32 loads a loader from there. This loader injects version 4.3.3-alpha1 of Amatera into memory.
Amatera malware exploits credentials and cookies stored in the browser itself. In recent builds, they go as far as obtaining the keys from 64-bit processes protected by Chromium’s Application-Bound Encryption mechanism. Delivery is done by hijacking an existing thread pool instead of creating a remote one.
The Captcha Was Fake. So Was the Lock Screen.
SynkLoader Rebuilds The Windows Lock Screen
The second family employs a completely different approach to achieving the same goal. SynkLoader was detected on August 18, 2026, after a scheduled task ran in a customer environment raised the alarm. The file’s timestamps suggest its development took place between July 28 and July 31, 2026.
The threat actors pretend to be internal IT support via Microsoft Teams, leading the victim to download a phony installer for PowerShell Cleaner, which is stored in Azure blob storage. The MSI unpacks a PowerShell script and a Python-based loader that checks in at one of the three hardcoded control servers every 90 to 120 seconds.
There are seven modules known at the moment, which were developed using Python, PowerShell, C# and C++ languages. TrafficRedirector is the backconnect proxy; StreamMaster is the VNC-style remote control component. System profiler collects information about the Active Directory network the compromised host belongs to.
But PhishLocker deserves special attention. It retrieves the current user’s name and lock-screen wallpaper, then opens a full-screen window that users can easily mistake for the Windows 11 password prompt. Entering the password in this window provides the threat actors with valid domain credentials. But pressing Alt+Tab closes the illusion.
What The Operators Want Is Still Unconfirmed
No affiliation has been associated with either campaign. The ultimate purpose for which SynkLoader was created is yet unknown, and the claim linking this malware to ransomware operators and the initial access broker lacks medium confidence.
Nevertheless, the structure of the toolkit is telling. Active Directory enumeration, proxy tunnels, and compromised domain credentials constitute the arsenal of an operator prepping up the infrastructure for sale or for encryption. Nothing of the sort suits a person looking for a quick buck. Compromised credentials can easily be obtained through infostealers which were responsible for about 1.8 billion of the latter in 2025.
We have tracked this pattern before, including a ClickFix campaign that abused DNS queries.
Every Step Runs Through Something Trusted
Let’s take a look at what really executes in these chains. conhost, rundll32, msiexec, PowerShell, Python. All these binaries carry valid signatures and perform their expected daily functions. The user voluntarily opened the gate, and the attacker never had to cross the perimeter.
There isn’t much for a detection engine to pick up on based on anomalies here. No exploit occurred; no unsigned binary was placed on disk; no suspect login occurred. The malicious component is a DLL that gets loaded from a remote share and a payload reassembled using a wordlist in memory.
Execution Governance alters the fundamental question. Instead of asking if the action seems suspicious, kernel-level enforcement asks if the code performing that action is authorized and trusted. A DLL downloaded from the attacker’s WebDAV share isn’t. Therefore, the Kernel API Virtualization environment executes the code even when a regular process appears to load it. The environment virtualizes file writes, sandboxes registry modifications, and blocks network connection attempts, rendering the infostealer ineffective.
Conclusion: The User Approved the Action. Not the Intent.
The defining lesson from WordlistLoader and SynkLoader is that attackers do not always need an exploit when they can persuade a user to initiate the critical action for them.
The two campaigns take different routes. WordlistLoader uses a fake CAPTCHA to convince the target to paste a command into the Windows Run dialog, after which trusted Windows utilities help retrieve and load code that ultimately delivers Amatera. SynkLoader impersonates IT support, directs the victim to a fake cleanup installer hosted on legitimate Azure infrastructure, and later uses PhishLocker to reproduce the Windows 11 lock screen and collect a password directly. One turns a pasted command into execution. The other turns familiar support and authentication interfaces into trust mechanisms.
Both expose the same defensive weakness, legitimate infrastructure, Windows binaries with valid signatures, and user-approved actions do not prove that an organization authorized the underlying code. WordlistLoader reinforces that problem by reconstructing executable content from ordinary English words or UUIDs only at runtime, while its execution chain attempts to interfere with security visibility. Trust therefore has to extend beyond what the user clicked and what process name appears in the tree.
Why This Threat Matters
- The user becomes part of the execution chain. ClickFix does not execute until the target pastes the command, while SynkLoader depends on the victim running a disguised installer.
- Legitimate infrastructure can strengthen the deception. Azure hosting, compromised legitimate websites, and blockchain-based delivery can make attacker-controlled content appear less suspicious.
- Signed processes do not make the loaded code trusted.
conhost,rundll32,msiexec, PowerShell, and Python can perform legitimate functions while participating in attacker-directed execution. - Payload representation is cheap to change. Wordlists and UUIDs can represent the same executable content while breaking rules tied to a previous encoding format.
- Credential theft occurs through different mechanisms. Amatera targets browser credentials and cookies, while PhishLocker directly captures the password entered into its cloned Windows prompt.
- Attribution and ultimate purpose remain unresolved. The observed capabilities support credential theft, remote access, and network discovery, but a later ransomware or initial-access-broker objective remains an assessment rather than a confirmed outcome.
Where Defensive Control Must Operate
Defense must operate at both the human decision and the execution boundary.
Xcitium Cyber Awareness Education and Phishing Simulation address the social-engineering layer by preparing users to recognize fake CAPTCHA instructions, unexpected IT-support requests, disguised installers, and cloned authentication prompts.
When those decisions still lead to code execution, Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform provides the execution layer. Execution Governance evaluates the trust of unknown code rather than granting it unrestricted runtime rights because a user initiated the action or a legitimate Windows process loaded it.
The important distinction is authorization. A user can approve an action without understanding the code or intent behind it.
Train the User. Govern the Execution.
Organizations should treat requests to paste commands into Run or terminal interfaces as a high-risk social-engineering pattern and verify unexpected software requests from IT support through a separate trusted channel.
But awareness cannot be the final security boundary. Users can still make convincing mistakes. The stronger architecture assumes that possibility and ensures that unknown execution still has to earn the rights required to modify the system, establish persistence, or communicate outward.
