WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Cybersecurity researchers have identified two new malware families, WordlistLoader and SynkLoader, which are used to deliver additional payloads and may be sold to ransomware groups. WordlistLoader is specifically being used to deliver the Amatera Stealer through ClearFake campaigns that utilize ClickFix, also known as FakeCaptcha. SynkLoader is used for phishing Windows passwords. These malware families are likely part of a larger operation to gain access to systems and sell that access to other malicious groups. The discovery was made by researchers at Gen Digital.