WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha)

Researchers report two new malware families, WordlistLoader and SynkLoader, used to deliver next-stage payloads and sell access to ransomware groups, with WordlistLoader distributing the Amatera Stealer via ClearFake campaigns that abuse ClickFix/FakeCaptcha techniques. These campaigns focus on credential theft and access brokerage in the broader cybercrime ecosystem. From a RealGround perspective, such malware-driven access and infostealing increase the likelihood that attackers can harvest AI service credentials or admin accounts, then weaponize access to AI agents and their surrounding infrastructure. Continuous AI red teaming can help organizations test how well their AI systems withstand compromised user endpoints and stolen credentials, including hardening authentication, session management, and agent-level authorization against this class of threat.