New Malware Families Deliver Stealers via Phishing Campaigns

Cybersecurity researchers identified two previously unknown malware families named WordlistLoader and SynkLoader, which deliver next-stage payloads and likely sell access to ransomware groups ¹.

WordlistLoader delivers Amatera Stealer—also known as ACR Stealer or AcridRain Stealer—to infected machines through ClearFake campaigns using the ClickFix technique. These campaigns trick users into interacting with a legitimate-looking login prompt while secretly installing malicious code; once installed, the stealer harvests credentials from browsers, email clients, and other applications before exfiltrating them over an encrypted channel ¹.

SynkLoader operates similarly but focuses more directly on phish­ing Windows passwords. By presenting a convincing credential-collection interface it captures user input and forwards it to attackers’ command‑and‑control servers, enabling the capture of valid logins that could facilitate lateral movement within corporate networks.

The Amatera/AcridRain Stealer has been circulating since early 2024 and evades detection by using dynamic API calls rather than static signatures common in malware scanners.

ClearFake campaigns leveraging “ClickFix” were first observed targeting cryptocurrency users two years ago as an alternative method to deliver trojans like Raccoon Stealer, which was widely used at the time.

For security teams, the emergence of WordlistLoader and SynkLoader signals that defensive strategies must evolve beyond signature-based detection. Behavioral analysis capable of spotting anomalous UI interactions—such as fake captchas or unexpected credential prompts—will become increasingly critical. Additionally, organizations should consider tightening outbound network controls to limit exfiltration paths and employ multi‑factor authentication wherever possible to mitigate credential theft from stealers.