ClearFake Campaigns Utilize WordlistLoader to Distribute Amatera Infostealer

A new malware campaign identified as ClearFake employs a loader named WordlistLoader to deploy the Amatera infostealer, targeting Windows users. This loader reconstructs shellcode from encoded English words, enhancing its evasion capabilities against detection. The Amatera infostealer has advanced features, including Heaven’s Gate for syscall evasion and hijacked thread pools for browser injection. The infection chain begins with compromised websites that display fake CAPTCHA prompts. Security researchers recommend implementing clipboard protections and monitoring for unusual process behavior related to conhost.exe and WebDAV connections. Organizations are advised to isolate affected hosts immediately and conduct memory forensics to identify any injected shellcode. The campaign's sophistication indicates a significant threat to sensitive data stored on infected systems.

Key Points: • ClearFake uses WordlistLoader to deliver the Amatera infostealer, enhancing evasion tactics. • The malware targets Windows users through compromised websites and fake CAPTCHA prompts. • Organizations should implement specific protections and monitor for unusual process behaviors.