WordlistLoader delivering Amatera

Summary

Gen Threat Labs published this analysis on 18 August 2026, naming a new loader, WordlistLoader, that it has only seen delivering Amatera Stealer, one of the most common stealers among Gen's users. Delivery runs through ClearFake: script injected into compromised, legitimate sites fetches further code from a blockchain smart contract and draws a fake CAPTCHA over the real page. Ticking the box copies a command the visitor is told to paste into the Run dialog; it starts a hidden command shell, maps a WebDAV share on a random-looking subdomain and runs the loader DLL through rundll32. The loader restores hooked functions, blinds Event Tracing for Windows, and rebuilds its shellcode from ordinary English words, one word per byte, while another variant uses UUIDs instead. Gen follows the Amatera builds it delivers up to version 4.3.3-alpha1.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 3 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

46 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.