Hackers Hide Malware Code Inside English Words to Infect Windows Users
.webp)
A new Windows malware campaign is hiding malicious code inside ordinary English words, making the payload look less suspicious during analysis. The technique is being used to deliver Amatera Stealer, an information-stealing threat that targets sensitive data stored on infected systems. The campaign relies on ClearFake, a long-running operation that compromises legitimate websites and places \[…\] The post Hackers Hide Malware Code Inside English Words to Infect Windows Users appeared first on Cyber Security News.
A new Windows malware campaign is hiding malicious code inside ordinary English words, making the payload look less suspicious during analysis.
The technique is being used to deliver Amatera Stealer, an information-stealing threat that targets sensitive data stored on infected systems.
The campaign relies on ClearFake, a long-running operation that compromises legitimate websites and places fake CAPTCHA checks over real pages.
Visitors are told to complete a verification step, but the prompt actually guides them into running a malicious command through the Windows Run dialog.
Analysts at GenDigital identified the new loader, called WordlistLoader, and found that it rebuilds hidden shellcode from a list of common English words.
The approach gives attackers another way to conceal code while keeping the infection chain focused on human error rather than a software vulnerability.
[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)GenDigital said in a report shared with Cyber Security News (CSN) that the immediate risk falls on Windows users who follow unexpected browser instructions, especially requests to press Win+R, paste clipboard content, and hit Enter.
Such ClickFix-style lures have become a common delivery method for information stealers because they persuade victims to launch the malicious command themselves.[](https://cybersecuritynews.com/new-clickfix-attack-leverage-windows-run-dialog-box/)
Hackers Hide Malware Code Inside English Words
--------------------------------------------------
WordlistLoader stores its next-stage code as a sequence of plain English words. Each word corresponds to a single byte through a build-specific list containing 256 unique words.
The loader processes the word sequence, finds each word’s position in the list, and writes the matching byte into memory. In simple terms, a harmless-looking list of words becomes executable malware only after the loader translates it back into machine code.
This makes static inspection harder because security tools and analysts may initially encounter readable text instead of an obvious block of shellcode.
GenDigital also found a modified WordlistLoader variant that swaps the English-word list for UUID values. In that version, each UUID represents a 16-byte chunk of code, showing that the operators can change the encoding method without changing the broader execution flow.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)
The loader is not limited to hiding code. Before it launches the reconstructed payload, it checks whether another copy is already running, attempts to restore altered system-module functions, and interferes with Windows event logging.
These actions are designed to make security monitoring and investigation more difficult. [](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)The campaign begins on hacked websites where attackers inject JavaScript into otherwise legitimate pages.
The injected code can use EtherHiding, a technique that retrieves further malicious content from a blockchain smart contract, before presenting a fake CAPTCHA to the visitor.
Readers can see how similar ClickFix campaigns use EtherHiding to turn browser visits into malware delivery attempts.[](https://cybersecuritynews.com/clickfix-campaign-uses-etherhiding-and-guloader/)[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)
Fake CAPTCHA Leads to Amatera
---------------------------------
After a visitor clicks the fake “I’m not a robot” prompt, the site copies a command to the Windows clipboard.
The victim is then instructed to open the Run dialog and paste it, unknowingly starting a hidden command process that accesses a remote WebDAV share and launches a malicious DLL through rundll32.
This delivery method is particularly effective because it uses built-in Windows components rather than requiring a traditional exploit. A related WebDAV rundll32 ClickFix technique shows how attackers continue to adapt trusted system tools for malware execution.[](https://cybersecuritynews.com/new-clickfix-variant-uses-rundll32/)[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)
WordlistLoader eventually launches Amatera, also known as ACR Stealer. Amatera has been actively updated and includes stronger code obfuscation, methods to avoid security hooks, and routines aimed at recovering protected browser encryption keys.
Previous reporting on the Amatera stealer web campaigns documented its use of compromised websites and fake verification prompts.[](https://cybersecuritynews.com/hackers-deliver-amatera-stealer/)[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)
The stealer can target browser-held information, including credentials and data that may be valuable for account takeover or further fraud.
Its newer versions also use techniques intended to interact with 64-bit browser processes and obtain keys protected by Chromium’s Application-Bound Encryption feature.[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)
Users should treat any CAPTCHA, browser warning, or website verification request that asks them to open Run, Terminal, Command Prompt, or PowerShell as malicious. Legitimate CAPTCHA services do not require users to paste commands into Windows.
Organizations should also monitor for unusual rundll32 activity, clipboard-triggered command execution, WebDAV connections, and visits to compromised sites. Similar fake CAPTCHA malware attacks underline why user awareness remains a critical part of endpoint defense.[](https://cybersecuritynews.com/fake-captcha-attack-leverages-microsoft-application-virtualization/)
The WordlistLoader delivers Amatera through ClearFake campaigns, combining deceptive website overlays with layered code hiding and defensive evasion.
Indicators of compromise (IoCs):-[](https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/32348cbe-993c-4a37-a1e1-b59f045d4b8d/Hackers-Hide-Malware-Code-Inside-English-Words-to-Infect-Windows-Users.pdf?AWSAccessKeyId=ASIA2F3EMEYERWUVIX3R&Signature=N96YqV5Z%2BJ7H9E9%2FJhCWwdnxFbM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCOU2ScCt74HUuyudIpP75KfMvrEuXz%2B6Ene7yiW2ysnwIgSv4KDXppjZ%2FN2Pbq9sWLIWxvDD94NJ5BaPqDq%2BVTd80q%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDDhx%2FdB6rtlaxSoMQirQBO9Gwi9P%2F%2Bt3NV%2FZqSyroCHwIwK6BjrCWXUcETrFw4q4%2FpFN%2BW53W2%2FvgyF6tqGzQR8B6gEaJUf636eCT3XWqw2t5kEGSOjVNuZy22hsyLNCSRSFPupUA3Rc2KEnQ%2BDjFPdJvjxM5W8t0c2I1ggKysojgp9SsFwkLkaeTnZcv9u2O4qxgQqbQwclw41u1t1ilt9M7tni7GLkaEObx3s8ruCGgZUYQm75MLx2dcvWEcr5ZxbBUwAxOMYX0dAawyyGqdO8XPT2UuwU9gZ6hP2KDBQoOw6Jej60fkUWvp0hCydzKkgYltT%2BuiL3F40kCt3pReyXaIMWmtn8w7cbnmMP1gHFuX2V0JkL0K5dMUNeMXUQMix4g5X8Ce1U4ssiKrcanSryzZnt%2Bt4NIp11wZ53kVEHtL8pg94cNyPJS1l4M7cRKPQGBVTlYjMRX5410jPMZnr3v24FhM4uOeQP0P36ybpX0f66dvad%2BwTN3e%2FGVToMVV80fX5Mdc0lrYp1X6oz8wxgzbMwBMfZUPjSeQLUSIfEbXZA6NQ44jZlZ5gSYB0Cr7lUQBSo90MS%2BKuukSITHvPOc8qLjJ5PEFEyhUVVO1OnWRRJi9FhJstEoi2H8yFqdUss6XQwQXXwPnVZO%2BCVReL4xPmZCDuJ%2Br%2BDwpSA%2BSPlxkMYou9cxnRZIfyQc4pH1EpfqFefh2PXRuaso0LMoyBp9JM%2BIb6AFibMYh9YMMWbEGh8%2BSlOeTa3fkrF5A%2FitrwAxnSF0Pmi6F5YNP3z%2FpM454J2kwyvs3rOKuX0G6YwyMKb1AY6mAH6mmSdDqONFe3wgLrqUzTC74dbpO8zfzzj%2BnhK%2BrbDrMJ7TshS55cgQectQe85%2Fw79klj1zIMItHO%2BbrFxXh%2Bd4B2Dul4oo09tzHiQlgNMuM8d1spsxqDtTPuUPZMkZi3mQcCIlJtSG8Lt50CMnVhgAmMd2fhYuqJ%2FlXDg0zvIL%2FWWOMcgLrRdUxDNGQZwrEHZBmymgQd5dw%3D%3D&Expires=1787227931)
| Type | Indicator | Description |
| --- | --- | --- |
| Compromised website | abogadosrosarinos\[.\]com | Observed serving ClearFake fake CAPTCHA content |
| Compromised website | aptisweb\[.\]com | Observed serving ClearFake fake CAPTCHA content |
| Compromised website | avene-hebergement\[.\]com | Observed serving ClearFake fake CAPTCHA content |
| Compromised website | https-xhamster\[.\]com | Observed serving ClearFake fake CAPTCHA content |
| Compromised website | www\[.\]caesarjaco\[.\]co\[.\]id/jasa-pengiriman-hewan | Observed serving ClearFake fake CAPTCHA content |
| Compromised website | skybap\[.\]shop | Observed serving ClearFake fake CAPTCHA content |
| Domain | shop-nitrilean\[.\]com | WebDAV infrastructure referenced in malicious clipboard commands |
| Domain | shop-thyrafemmebalance\[.\]com | WebDAV infrastructure referenced in malicious clipboard commands |
| File name | gmwmvymdzgqgptwvbslq.dll | WordlistLoader DLL observed in a malicious command |
| File name | azjsbxanuofzndqtmtlv.dll | WordlistLoader DLL observed in a malicious command |
| File name | dldwwqhuxbpvaqeyylar.dll | WordlistLoader DLL observed in a malicious command |
| SHA-256 | eb883ff84700245a199dfbe120c3c2012b2dbf1ec97b26721fbda3ee7445c85ac | WordlistLoader sample |
| SHA-256 | d598cea811d8f73ca7afffa40e5963be9a82e01bad8ffcebb104b475c091faa84 | WordlistLoader sample |
| SHA-256 | ffddad7e2eb1f476b857321b0cd54a7a283dbdb82bd3a13ea1b49862595d20124 | WordlistLoader sample |
| SHA-256 | f2104ca9ee75a99aa998bb016c202f43b890d0173213846fa2495db7fa0d79f3c | WordlistLoader sample |
| SHA-256 | 2d1f150516edcdc274c3791f4e8301807b479ddf796fc019bc910054e3a19a2d | WordlistLoader UUID variant |
| SHA-256 | 02fa59501e1438f852250c4fdb24086d8a0184ece32240091f91515bbf7d | WordlistLoader UUID variant |
| SHA-256 | e37cc7f678aa800b805aefcc57ad86251cb7b89a044c43c72be9a77f36a88e57 | WordlistLoader UUID variant |
| SHA-256 | 596f7b1edd97a4e114413b6668151cae3c8a5c7729208d5c2150e65f9ceca6d7 | WordlistLoader UUID variant |
| SHA-256 | 5f5b7c131c852275123ad55028c5f87692f4b206591011a13da5b085dc4df8fd | WordlistLoader UUID variant |
| SHA-256 | 25fdc2c589a7df6dc45798b1a4a97a6a1d62d12326151e4a9a9d50fea8111b29 | WordlistLoader UUID variant |
| SHA-256 | 9a969110c055c3f48af75ce8d2b75c2e7b898a4519a700c7a0cd1fcbc993ecad | Amatera 4.3.3-alpha1 |
| SHA-256 | 7b8c30af2ca566927fb91e08c33ebb92089e86afb70d74715e5c7d8de6f9ecfc | Amatera 4.3.3-alpha1 |
| SHA-256 | d9402b049738d4679cb46f09d2511b9ac8f6842ffed29560a7e96046a811e841 | Amatera 4.3.1-alpha1 |
| SHA-256 | 54ba68040413b23128455952e4a698df112a163d0498ded6f77e863d15113133 | Amatera 4.2.4-alpha2 |
| SHA-256 | 8672bc4c60a731f80a57deb564f9b78b1a91607a1b5c20c12767a8ab72b09b6a | Amatera 4.2.3-alpha1 |
| SHA-256 | 42095fff1452418550440d5adff87a10e6d04a704fedf2b221f83b6a974a0d73 | Amatera 4.2.2-alpha1 |
| SHA-256 | 38ad801509af109dcd12a56ac931b795e39a7fcd5cd43698cccb7e051298a683 | Amatera 4.2.1-alpha1 |
| SHA-256 | 88f769cf7c88e3bbbd1b72d8124b9a4b39ba8fe3e80ff76d682493033c34a598 | Amatera 4.2.0-alpha3 |
| SHA-256 | c4390e74aecd06d3bb355af7f403de0655d28cdc54fa68b1596d91c2b3bb0e46 | Amatera 4.2.0-alpha2 |
| SHA-256 | ee394ed8118d22da6054ebec9434c4c7256af27e0cb479e17100e56f7b150b25 | Amatera 4.2.0-alpha1 |
| SHA-256 | 90b7c9e9910c3512f4793b577a0b9025e8995cd67ee36e46f36b7b7b80b4d65f | Amatera 4.1.5-alpha |
| SHA-256 | fee8d5964fcc23027685ee1124a19127ce58d4692c9df831bd1b900cdb86faeb | Amatera 4.1.4-alpha |
| SHA-256 | 147276f871a5a33a611a6ee112137f3aae136ea79fcbf07361cb7d0d26c87e4d | Amatera 4.1.1 Beta |
| SHA-256 | 2833fb725862866205b37619db050fbd84e6258682fa1d9485da0ae9257b9244 | Amatera 4.1.0-alpha.1 |
| C2 domain | health\[.\]luminexus\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | stream\[.\]luminfrastructure\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | stream\[.\]threatenbrick\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | yw\[.\]enhanceblabber\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | pmpo\[.\]cloudvector\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | dust\[.\]packetflow\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | updates\[.\]wildtrail\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | app-api\[.\]lensstory\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | proxy\[.\]fluxautomation\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | stream\[.\]pawpalace\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | dist\[.\]runtimeconsole\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | id\[.\]binaryharbor\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | wss\[.\]infrastructurecore\[.\]cc | Amatera command-and-control infrastructure |
| C2 domain | id\[.\]exhumepacifier\[.\]cc | Amatera command-and-control infrastructure |
| Dead-drop URL | telegra\[.\]ph/Executing-modules-as-scripts-06-16 | Amatera dead-drop location |
| Dead-drop URL | telegra\[.\]ph/Using-Python-as-a-Calculator-06-05 | Amatera dead-drop location |
| Dead-drop URL | telegra\[.\]ph/Jack-Little-04-18 | Amatera dead-drop location |
| Dead-drop URL | telegra\[.\]ph/Parameters-04-03 | Amatera dead-drop location |
| Dead-drop URL | telegra\[.\]ph/Jewel-03-06 | Amatera dead-drop location |
| Dead-drop URL | telegra\[.\]ph/Catnap-Skimmed-03-06 | Amatera dead-drop location |
Note: _IP addresses and domains are intentionally defanged (e.g.,_ _[.]__) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM_.
*****Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC*****
The post Hackers Hide Malware Code Inside English Words to Infect Windows Users appeared first on Cyber Security News.