Hackers Hide Malware Code Inside English Words to Infect Windows Users

Cybersecuritynews •Tushar Subhra Dutta • August 20, 2026

A new Windows malware campaign is hiding malicious code inside ordinary English words, making the payload look less suspicious during analysis. The technique is being used to deliver Amatera Stealer, an information-stealing threat that targets sensitive data stored on infected systems. The campaign relies on ClearFake, a long-running operation that compromises legitimate websites and places […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClearFake Campaigns Utilize WordlistLoader to Distribute Amatera Infostealer A new malware campaign identified as ClearFake employs a loader named WordlistLoader to deploy the Amatera infostealer, targeting Windows users. This loader reconstructs shellcode from encoded English words, enhancing its evasion capabilities against detection. The Amatera infostealer has advanced features, including Heaven’s Gate for syscall evasion and hijacked thread pools for browser injection. The infection chain begins with compromised websites that display fake CAPTCHA prompts. Security researchers recommend implementing clipboard protections and monitoring for unusual process behavior related to conhost.exe and WebDAV connections. Organizations are advised to isolate affected hosts immediately and conduct memory forensics to identify any injected shellcode. The campaign's sophistication indicates a significant threat to sensitive data stored on infected systems. 6 sources 71

Extracted Entities

Hackers Hide Malware Code Inside English Words to Infect Windows Users

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)