WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Researchers have identified two active malware families—WordlistLoader and SynkLoader—being used to deliver the Amatera (ACR/AcridRain) stealer and to harvest credentials and provide remote access. Distribution leverages ClearFake/ClickFix lures on compromised websites (with EtherHiding and CDN abuse), WebDAV-based DLL loading via rundll32, and a Microsoft Teams phishing campaign that installs an MSI leading to a Python-based loader; SynkLoader includes modules for persistence, fake lock-screen credential capture, reverse proxying, RAT functionality and VNC streaming.