[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP-85VSOPpmJXTlMMjkuvgrES6Lw0fL4Yi0GDRROAXrQ":3},{"article":4,"iocs":43,"watch_terms":58,"solutions":59,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"568d9587-064d-44b1-8796-3579e0d71d05","WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords","wordlistloader-delivers-amatera-via-clickfix-synkloader-phishes-windows-password-eef5e5","Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha)","Two new malware families, WordlistLoader and SynkLoader, have been identified by cybersecurity researchers. WordlistLoader is used to deliver the Amatera Stealer via ClearFake campaigns, which leverage a ClickFix technique to trick users into executing malicious commands. SynkLoader is designed to phish Windows passwords. Both malware families are suspected of selling access to ransomware groups.","New malware families WordlistLoader and SynkLoader deliver Amatera Stealer and phish Windows passwords.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fwordlistloader-delivers-amatera-via.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjNZ5JtaLAZIvAO7R42dqB1NBKwtOlFHZIl0yqtfPhyphenhyphenHMJB9MMg8oLLb8p6n9mF67PgHSytYigaqeAoGejuVd42lDlCT42T6vqCgfl6IE-8LnMQjyiCj8MVMdg5ZKznn2cZ18T9zubhLJ-JUZLSWeqEVGQbke44f83WHpoMuaVM9J6G0FA-9RG8_wb8lUTt\u002Fs1600\u002Fwindows-signin.jpg","2026-08-24T12:35:36+00:00","2026-08-24T14:00:05.602407+00:00",8,[17],{"name":18,"type":19},"ClearFake","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,50,52,54,56],{"type":45,"value":46,"context":47},"domain","abogadosrosarinos[.]com","Compromised website serving ClickFix prompts",{"type":45,"value":49,"context":47},"aptisweb[.]com",{"type":45,"value":51,"context":47},"avene-hebergement[.]com",{"type":45,"value":53,"context":47},"https-xhamster[.]com",{"type":45,"value":55,"context":47},"www.caesarjaco.co[.]id",{"type":45,"value":57,"context":47},"skybap[.]shop",[],{"controls":60,"vendors":142},[61,90,116],{"slug":62,"name":63,"problem":64,"products":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":91,"name":92,"problem":93,"products":94},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[95,103,108],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":104,"product_name":105,"url":106,"description":107},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":117,"name":118,"problem":119,"products":120},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[121,129,135],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":117,"product_name":139,"url":140,"description":141},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[143],{"slug":67,"name":68,"logo_path":69,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":161},"clickfix-social-engineering-delivers-stealers-and-password-phishing-malware","ClickFix Social Engineering Delivers Stealers and Password Phishing Malware","WordlistLoader and SynkLoader exploit human trust by tricking users into manually executing malicious commands through a technique called ClickFix, which bypasses many automated defenses by making the victim the unwitting executor of the attack. This matters because social engineering-driven execution chains are increasingly difficult to block with technical controls alone — user behavior is the last line of defense. Both malware families are linked to ransomware access brokering, meaning a single successful infection can escalate into a full organizational compromise. The combination of credential theft and stealer functionality gives attackers everything they need to move laterally and monetize access rapidly.",[151,152,153,154,155,156,157,158,159,160],"CIS Control 14 - Security Awareness and Skills Training","CIS Control 10 - Malware Defenses","CIS Control 16 - Application Software Security","NIST SP 800-53 AT-2 (Literacy Training and Awareness)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-63B (Digital Identity Guidelines - Phishing-Resistant MFA)","MITRE ATT&CK T1204.002 (User Execution: Malicious File)","MITRE ATT&CK T1056.001 (Input Capture: Keylogging)","GDPR Article 32 (Security of Processing - credential protection obligations)",{}]