WordlistLoader Delivering Amatera via ClearFake Campaigns
August 18, 2026 · Gen Digital · Severity: MEDIUM
Gen Threat Labs has identified WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in the Gen user base. Key changes in the latest version include enhanced static obfuscation, hardened syscall invocation through the WoW64 transition, dynamically generated x64 indirect-syscall trampolines invoked through Heaven's Gate, and a redesigned Application-Bound Encryption bypass. Amatera is being distributed via ClearFake campaigns leveraging FakeCaptchas, which has proven to be one of the most effective social engineering techniques for luring victims into infecting their own machines.
Key Takeaways
- WordlistLoader is a new loader delivering Amatera Stealer through ClearFake campaigns using FakeCaptcha social engineering.
- Amatera has evolved with enhanced obfuscation, hardened syscall invocation, and a redesigned Application-Bound Encryption bypass.
- FakeCaptcha remains one of the most effective social engineering techniques for tricking users into self-infection.