Researchers have identified a novel malware loader that uses common English words to hide and reconstruct malicious code, enabling the delivery of the Amatera infostealer. This technique, observed in recent ClickFix-style campaigns, allows threat actors to bypass traditional detection methods by blending malicious payloads into seemingly benign text. The loader was discovered in early 2024 as part of a growing trend in evasion tactics targeting information-stealing malware.
The WordlistLoader operates by splitting malicious code into fragments and encoding each piece using indices from a predefined list of ordinary English words. When executed, the loader reassembles the fragments in memory to reconstruct the Amatera infostealer, which then exfiltrates sensitive data such as login credentials, browser cookies, and cryptocurrency wallet information. This method reduces the loader’s digital footprint, making it harder for antivirus software and sandbox environments to flag the activity as malicious. Security analysts note that the use of common language patterns helps the malware blend into normal network traffic and file systems, increasing its chances of successful deployment.
Unlike conventional malware that relies on obfuscation or encryption, WordlistLoader avoids suspicious patterns by using harmless-looking word sequences. Each word in the list acts as a pointer to a code segment, meaning the loader itself contains no executable code until runtime. This fileless characteristic allows it to operate entirely in memory, leaving minimal traces on disk. Experts warn that this approach complicates forensic analysis and signature-based detection, as the loader appears as a benign text file or script until activated. The technique reflects a broader shift toward living-off-the-land and language-based evasion strategies in cybercrime.
Amatera has gained traction among cybercriminals due to its modular design and ability to steal a wide range of data, including autofill information, session tokens, and FTP credentials. It is often distributed through phishing emails, fake software updates, and compromised websites, with ClickFix-style lures tricking users into enabling malicious content under the guise of fixing system errors. Recent telemetry shows a 40% increase in Amatera-related incidents over the past six months, particularly targeting users in North America and Europe. Its integration with loaders like WordlistLoader suggests a maturing ecosystem where evasion techniques are rapidly adapted to maximize infection rates.
How does WordlistLoader reconstruct the malware? It uses a list of common English words where each word corresponds to a specific code fragment; during execution, the loader maps these words to reassemble the Amatera infostealer in memory.
Why is this technique effective against antivirus tools? Because the loader contains no overtly malicious code until runtime and relies on ordinary language, it avoids triggering heuristic or signature-based detections that look for known malicious patterns.
Who is most at risk from this threat? Users who interact with unverified links, download pirated software, or enable macros in suspicious documents are most vulnerable, especially if their systems lack behavioral monitoring or memory protection tools.