New WordlistLoader and SynkLoader Malware Families Target Windows Users

Cybersecurity researchers at Gen Digital have disclosed two new malware families, WordlistLoader and SynkLoader, that are actively used in campaigns to compromise Windows systems. The findings, reported on August 24, 2026, reveal that WordlistLoader is being used to deliver Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) via ClearFake campaigns that employ the ClickFix (FakeCaptcha) social engineering technique. SynkLoader, on the other hand, is designed to phish Windows passwords and may be used to sell access to ransomware groups.

WordlistLoader operates by tricking users into executing malicious commands through fake CAPTCHA prompts, a technique known as ClickFix. Once executed, it downloads and runs Amatera Stealer, which is capable of exfiltrating sensitive data such as credentials and personal information. The use of ClearFake campaigns suggests a sophisticated distribution chain that leverages compromised websites to display fake verification pages.

SynkLoader appears to focus on harvesting Windows passwords, likely through phishing lures. The stolen credentials could be used for initial access, which may then be sold to ransomware operators, as indicated by Gen Digital's analysis. The exact distribution methods for SynkLoader were not detailed in the report, but the potential for ransomware deployment makes it a significant concern.

The campaigns have been observed globally, though specific targets were not disclosed. The impact of these malware families includes data theft, unauthorized access, and potential ransomware attacks. Organizations and individuals are advised to be cautious of unsolicited CAPTCHA prompts and to implement robust endpoint protection and user awareness training.

No specific patches are available for these malware families, as they are not vulnerabilities but rather malicious software. Mitigation relies on user vigilance, email filtering, and endpoint detection and response (EDR) solutions. Gen Digital's research provides critical insights into these emerging threats, but details have not been independently verified.