A newly discovered malware loader uses lists of ordinary English words to conceal and reconstruct malicious code, helping a rapidly growing infostealer evade detection before infecting victims.
Researchers from Gen Threat Labs recently discovered WordlistLoader, a loader used to infect victims with the Amatera infostealer. As a loader, it exists between the initial infection and the final payload. Loaders can be used for a variety of purposes, such as getting deeper into a victim’s machine, evading defenses, downloading and decrypting later stage malware, or launching other necessary programs.
WordlistLoader’s job is to prepare the environment, evade security controls, reconstruct the next-stage payload, and then hand execution off to the infostealer. “Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base,” Gen Threat researcher Vojtěch Krejsa wrote in the report.
Amatera Stealer (as it’s usually referred to) has been in the wild for a little over a year and has become a popular malware-as-a-service strain. Proofpoint researchers said last June that the stealer is based on the ACR Stealer and is capable of sweeping up data for software wallets, cryptocurrency wallets, credentials, browser data, and message history.
Like the campaign Proofpoint disclosed a year ago, WordlistLoader is distributed via ClearFake campaigns seemingly targeting Windows machines. ClearFake is a threat cluster that delivers infections primarily via ClickFix-style attacks.
How WordlistLoader Uses Plain English to Rebuild Malware
WordlistLoader includes four key functions, according to the Gen report. The primary one is that it “reconstructs shellcode that serves as the entry point for subsequent stages.” WordlistLoader includes a series of plain English words that looks innocuous but can be translated back into executable code prior to running it. Its primary job is to reconstruct hidden malicious code that serves as the entry point for later stages of the infection chain.
“The mapping from English words to byte values is defined by a build-specific wordlist of 256 distinct words: the word at index 0 decodes to 0x00, the word at index 144 to 0x90, and so on,” Krejsa wrote. “Both the wordlist and the encoded sequence are stored as arrays of pointers, so the loader matches addresses rather than the strings themselves. Rebuilding the shellcode thus comes down to iterating over the word sequence, looking up each word in the list, and writing the index of the matching entry into the output buffer.”
WordlistLoader also unhooks loaded modules; many security products include “hooks” that they insert into various operating system functions as a monitoring tool. Its third feature includes a bypass for Event Tracing for Windows, a built-in Microsoft logging function that assists security tools with observing system activity. Lastly, the malware includes various anti-emulation and anti-analysis tricks to further help with evasion.
Combatting ClearFake, ClickFix, and Amatera
The ClearFake cluster is known for compromising legitimate websites and then planting fake CAPTCHA lures that use ClickFix-style social engineering to trick users into executing malicious commands.
Selena Larson, principal threat researcher at Proofpoint, tells Dark Reading that ClickFix-style attacks have become a popular part of the threat actor’s toolkit. The cybersecurity vendor first included it in its own ZenGuide awareness training in 2024.
“If organizations aren’t already incorporating ClickFix into their security training, they certainly should be. Based on conversations with various organizations and security teams, the majority are aware of it,” she says. “ClickFix and related techniques are among the most popular methods for delivery used by many different threat actors both in email and web inject initial access.”
Larson says, since 2025, Amatera has been used by multiple advanced cybercrime actors. Both she and Gen note that the malware is under continuous development, adding a number of improvements generally involving stealth.
“Stealers are increasingly popular, but the landscape is shifting rapidly,” she says. “Stealers can become less effective as detection and awareness improve, especially if they aren’t regularly maintained to evade defenses. Also, law enforcement targeting popular malware like StealC, Rhadamanthys, and Lumma Stealer have forced threat actors to go elsewhere, growing the popularity of other information stealers.”
