ClearFake Fake CAPTCHA Campaigns Use New WordlistLoader to Deploy Amatera Stealer

A new ClearFake infection chain using a previously undocumented intermediate payload dubbed WordlistLoader to deploy Amatera Stealer.

The campaign combines compromised websites, fake CAPTCHA overlays, ClickFix social engineering, WebDAV-hosted DLLs and advanced anti-analysis mechanisms to deliver one of the more actively evolving information stealers currently tracked.

Clicking the “I’m not a robot” control triggers a ClickFix sequence that copies a malicious command to the Windows clipboard and instructs the user to paste it into the Run dialog.

Gen notes that this approach remains highly effective because the victim, rather than an exploit, initiates the execution chain.

The injected code is delivered as a Base64-encoded JavaScript blob and retrieves further payloads from a blockchain smart contract through EtherHiding.

The resulting code performs validation checks before inserting the fake CAPTCHA into the compromised page.

Expel previously documented ClearFake’s broader use of living-off-the-land techniques and blockchain-hosted content in similar operations. Expel’s ClearFake analysis provides additional background on that infrastructure.

The copied commands use conhost --headless to conceal a command interpreter, map a remote WebDAV path with pushd, and execute a downloaded DLL’s Run export through rundll32.

This delivery style resembles a WebDAV-based ClickFix chain recently outlined by Microsoft in ACR Stealer activity, but replaces Python-based loaders with the new WordlistLoader component.

Microsoft’s ACR Stealer report details the related WebDAV and blockchain C2 tradecraft.

WordlistLoader is designed to reconstruct and launch a shellcode stage while suppressing defensive visibility.

It first enforces single execution through a named event, then attempts to unhook loaded modules by comparing in-memory function prologues against clean copies read from disk.

Rather than broadly comparing code, it looks for common detour opcodes such as E9, EB, EA, and FF 25, restoring original bytes when it identifies a hook.

Gen Threat Labs has identified WordlistLoader, ClearFake operators inject obfuscated JavaScript into legitimate but compromised websites, where it overlays a counterfeit CAPTCHA prompt on the victim’s browser session.

ClearFake Fake CAPTCHA Campaigns

The loader also bypasses Event Tracing for Windows by placing a hardware breakpoint on ntdll!NtTraceEvent and registering a vectored exception handler.

Each call generates a single-step exception, after which the handler redirects execution to a stub that returns success without allowing the event-writing function to execute.

This enables the malware to suppress telemetry while preserving an apparently successful return value.

Its defining feature is how it stores shellcode. WordlistLoader encodes each byte as an English word selected from a build-specific list of 256 entries.

The loader iterates through the word sequence, resolves each word’s index in the list and writes that index as the decoded byte.

Researchers also observed a variant that substitutes UUID strings for the wordlist, converting each UUID into 16 bytes using UuidFromStringA.

The decrypted shellcode includes a prolonged anti-emulation loop before unpacking a reflective loader that launches Amatera.

The reflective loader matches one previously documented in Amatera 4.0.2 Beta by eSentire, suggesting continuity between the loader chain and the stealer’s development ecosystem.

Amatera version 4.3.3-alpha1 substantially hardens the malware against analysis. It adds control-flow flattening, indirect control flow and per-resolver API-hashing routines, making static analysis and API identification more costly.

Its updated string protection uses a multi-round 64-bit transformation, while a deliberately unreachable branch manipulates the stack by nearly 2 GB a trick intended to break decompiler stack-frame recovery.

The 32-bit stealer has also strengthened its syscall evasion. It bypasses conventional 32-bit ntdll paths, transitions through WoW64, validates the wow64cpu.dll transition target and uses Heaven’s Gate to execute dynamically generated 64-bit indirect-syscall trampolines.

These mechanisms are designed to avoid user-mode hooks in both 32-bit and 64-bit API layers.

Amatera has further revamped its Application-Bound Encryption bypass for Chromium browsers.

The new implementation scans browser memory for cryptographic key structures, targets protected v20_master_key material and injects a larger payload using Windows thread-pool abuse via PoolParty variant 7.

Organizations should treat fake CAPTCHA prompts that instruct users to open Windows Run and paste commands as a high-confidence malicious indicator.

The technique reflects tradecraft previously associated with Lumma and Remus, including a near-identical memory-scanning signature. Gen’s Remus/Lumma research offers context on that ABE-bypass approach.

Defenders should monitor suspicious conhost, cmd, pushd, WebDAV, and rundll32 execution chains, block known malicious WebDAV destinations, and deploy browser and endpoint controls capable of detecting clipboard-based social-engineering activity.

Indicators of Compromise

Type	Indicator	Notes
Domain	abogadosrosarinos[.]com	Defanged domain
Domain	aptisweb[.]com	Defanged domain
Domain	avene-hebergement[.]com	Defanged domain
Domain	https-xhamster[.]com	Defanged domain
URL	www[.]caesarjaco[.]co[.]id/jasa-pengiriman-hewan	Defanged URL path: /jasa-pengiriman-hewan
Domain	skybap[.]shop	Defanged domain
Artifact / Tool Name	WordlistLoader	Potential malware component, loader, or detection label
SHA-256	eb883ff84700245a199dfbe120c3c2012b2dbf1ec97b26721fbda3ee7445c85a	64-character SHA-256 hash
SHA-256	cd598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa	64-character SHA-256 hash
SHA-256	84ffddad7e2eb1f476b857321b0cd54a7a283dbdb82bd3a13ea1b49862595d20	64-character SHA-256 hash
SHA-256	124f2104ca9ee75a99aa998bb016c202f43b890d0173213846fa2495db7fa0d7	64-character SHA-256 hash
SHA-256	9f3c2d1f150516edcdc274c3791f4e8301807b479ddf796fc019bc910054e3a1	64-character SHA-256 hash

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide