A newly identified loader called WordlistLoader is being used in ClearFake campaigns to distribute the Amatera infostealer. The loader reconstructs shellcode from encoded English words or UUIDs, helping it evade conventional detection. Amatera has also evolved with advanced evasion techniques, including Heaven’s Gate for syscalls and hijacked thread pools for browser injection.
The investigation examined the infection chain beginning with compromised websites displaying fake CAPTCHA prompts. Researchers analyzed WordlistLoader’s execution process, including module unhooking, ETW bypass through hardware breakpoints, and shellcode decoding from wordlists. The research also covered Amatera version 4.3.3-alpha1, highlighting its updated Application-Bound Encryption bypass and hardened syscall implementation.
Organizations should implement clipboard protections to reduce the risk of malicious commands delivered through social engineering. EDR solutions should be capable of detecting hardware breakpoint manipulation and ETW bypass attempts. Security teams should also monitor unusual process behavior, including conhost launching hidden cmd processes that use pushd to map remote WebDAV shares.
If the described command patterns are detected, the affected host should be isolated immediately to prevent further data exfiltration. Responders should perform memory forensics to identify injected shellcode or hijacked browser threads. Unauthorized WebDAV connections should also be investigated, along with endpoint logs that can reveal the source of the malicious command.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary seeks to deliver the Amatera infostealer while minimizing the footprint on the host. They initiate a hidden command prompt via conhost.exe --headless . Once the shell is established, the attacker uses the pushd command to mount a remote WebDAV (simulated via a local UNC path for testing purposes) to avoid the noise of net use . Finally, they execute the malicious component by calling rundll32.exe against a DLL located on that newly mapped drive, specifically invoking the Run export to begin the infection chain.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
