New Malware Hides in English Words to Target Windows Users
Key Takeaways A new malware loader, “WordlistLoader,” is actively targeting Windows users by disguising malicious code within common English words. This loader is part of the...
Key Takeaways
- A new malware loader, “WordlistLoader,” is actively targeting Windows users by disguising malicious code within common English words.
- This loader is part of the “ClearFake” campaign, which compromises legitimate websites to present fake CAPTCHA prompts.
- The ultimate payload is Amatera Stealer (also known as ACR Stealer), a potent information-stealing malware.
- The attack chain relies on social engineering, tricking users into executing commands via the Windows Run dialog rather than exploiting software vulnerabilities.
- No specific CVEs are associated with this social engineering attack; user vigilance and robust endpoint detection are crucial.
A sophisticated new malware campaign is leveraging an unusual obfuscation technique to target Windows users, embedding malicious code within seemingly innocuous English words. This method, identified by security researchers, allows the malware to evade detection during initial analysis, making the payload appear less suspicious.
Table Of Content
The primary objective of this campaign is to deliver Amatera Stealer, a dangerous information-stealing threat designed to exfiltrate sensitive data from compromised systems. The attack chain is intricate, relying heavily on social engineering to bypass traditional security measures.
The ClearFake Campaign’s Deceptive Lures
This novel attack is an evolution of the persistent ClearFake operation. ClearFake is notorious for compromising legitimate websites and overlaying them with fake CAPTCHA verification prompts. When users encounter these deceptive checks, they are instructed to complete a verification step that, in reality, tricks them into executing a malicious command through the Windows Run dialog.
Analysts at GenDigital were instrumental in uncovering this new loader, which they dubbed “WordlistLoader.” Their research revealed its unique capability to reconstruct hidden shellcode from a predefined list of ordinary English words. This innovative approach provides threat actors with an additional layer of stealth, allowing them to conceal their code while maintaining an infection vector that exploits human error rather than relying on software vulnerabilities.
GenDigital said in a report that the immediate threat is to Windows users who comply with unexpected browser instructions, particularly those that involve pressing Win+R, pasting clipboard content, and pressing Enter. Such “ClickFix-style” social engineering tactics have become a favored delivery mechanism for information stealers, as they manipulate victims into inadvertently launching the malicious commands themselves.
WordlistLoader: Hiding Code in Plain Sight
WordlistLoader’s primary innovation lies in its method of storing subsequent-stage code. It organizes the malicious payload as a sequence of everyday English words. Each word in this sequence corresponds to a specific byte, based on a unique, build-specific list containing 256 distinct words. The loader then processes this word sequence, determines the position of each word within its internal list, and writes the corresponding byte into memory. Essentially, a seemingly harmless collection of words transforms into executable malware only after the loader translates it back into its original machine code form. This technique significantly complicates static analysis, as security tools and human analysts initially encounter readable text instead of an obvious block of shellcode.
GenDigital’s investigation also uncovered a variant of WordlistLoader that substitutes the English word list with Universally Unique Identifier (UUID) values. In this alternative version, each UUID represents a 16-byte segment of code. This demonstrates the attackers’ flexibility in modifying their encoding methods without altering the fundamental execution flow of the malware.
Beyond its code-hiding capabilities, WordlistLoader incorporates additional evasive maneuvers. Before deploying its reconstructed payload, it checks for existing instances of itself, attempts to restore any modified system-module functions, and actively interferes with Windows event logging. These actions are specifically designed to hinder security monitoring and complicate forensic investigations.
The campaign’s initial phase involves compromised websites, where attackers inject JavaScript into otherwise legitimate web pages. This injected code can utilize EtherHiding, a technique that fetches further malicious content from a blockchain smart contract, before displaying the fake CAPTCHA to the unsuspecting visitor. This strategy highlights how ClickFix campaigns employ EtherHiding to transform routine browser visits into malware delivery attempts.
From Fake CAPTCHA to Amatera Stealer
Once a victim interacts with the fraudulent “I’m not a robot” prompt, the malicious website copies a command to the Windows clipboard. The user is then directed to open the Run dialog (Win+R), paste the copied command, and press Enter. Unbeknownst to the user, this action initiates a stealthy command process that connects to a remote WebDAV share and executes a malicious DLL via rundll32.
This delivery technique is particularly effective because it leverages legitimate, built-in Windows components, eliminating the need for a traditional software exploit. The use of a WebDAV rundll32 ClickFix technique exemplifies how attackers continue to weaponize trusted system tools for malware execution.
Ultimately, WordlistLoader deploys Amatera, also known as ACR Stealer. Amatera has undergone continuous development, incorporating enhanced code obfuscation, techniques to bypass security hooks, and routines specifically designed to recover protected browser encryption keys. Prior reports on Amatera stealer web campaigns have consistently highlighted its use of compromised websites and fake verification prompts.
The stealer is designed to compromise browser-stored information, including credentials and other data that could facilitate account takeover or subsequent fraudulent activities. Recent iterations of Amatera also incorporate advanced techniques to interact with 64-bit browser processes and extract keys safeguarded by Chromium’s Application-Bound Encryption feature.
The WordlistLoader, in conjunction with ClearFake campaigns, represents a sophisticated threat that combines deceptive website overlays with multi-layered code obfuscation and defensive evasion techniques. This makes it a significant challenge for both individual users and organizational security teams.
What You Should Do
- Exercise Extreme Caution with Browser Prompts: Never trust any CAPTCHA, browser warning, or website verification request that instructs you to open the Run dialog (Win+R), Terminal, Command Prompt, or PowerShell and paste commands. Legitimate CAPTCHA services do not require such actions.
- Educate Users: Organizations must prioritize user awareness training, emphasizing the dangers of social engineering tactics like fake CAPTCHAs and “ClickFix” lures. Users should be trained to recognize and report suspicious prompts rather than interacting with them.
- Monitor for Anomalous Activity: Implement robust endpoint detection and response (EDR) solutions to monitor for unusual rundll32 process activity, clipboard-triggered command execution, and suspicious WebDAV connections.
- Implement Network Filtering: Configure network perimeter defenses to block connections to known malicious domains and IP addresses associated with ClearFake and Amatera C2 infrastructure. Regularly update threat intelligence feeds.
- Regular Backups: Maintain regular, offsite backups of critical data to mitigate the impact of data theft or other malicious activities.
- Indicators of Compromise (IoCs): Leverage the provided IoCs to enhance your defensive posture. Integrate these into your SIEM, IDS/IPS, and other security tools for proactive detection. (Note: IP addresses and domains are intentionally defanged (e.g.,
[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM).
Type Indicator Description Compromised website abogadosrosarinos[.]com Observed serving ClearFake fake CAPTCHA content Compromised website aptisweb[.]com Observed serving ClearFake fake CAPTCHA content Comp Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
No Comment! Be the first one.