GenDigital said in a report shared with Cyber Security News (CSN) that
the immediate risk falls on Windows users who follow unexpected browser instructions, especially requests to press Win+R, paste clipboard content, and hit Enter.
Such ClickFix-style lures have become a common delivery method for information stealers because they persuade victims to launch the malicious command themselves.
WordlistLoader stores its next-stage code as a sequence of plain English words. Each word corresponds to a single byte through a build-specific list containing 256 unique words.
The loader processes the word sequence, finds each word’s position in the list, and writes the matching byte into memory. In simple terms,
a harmless-looking list of words becomes executable malware only after the loader translates it back into machine code.
This makes static inspection harder because security tools and analysts may initially encounter readable text instead of an obvious block of shellcode.
GenDigital also found
a modified WordlistLoader variant that swaps the English-word list for UUID values. In that version, each UUID represents a 16-byte chunk of code, showing that the operators can change the encoding method without changing the broader execution flow.
This delivery method is particularly effective because it uses built-in Windows components rather than requiring a traditional exploit. A related
WebDAV rundll32 ClickFix technique shows how attackers continue to adapt trusted system tools for malware execution.
WordlistLoader hides Amatera Stealer code inside common English words, using fake CAPTCHA pages to trick Windows users into running malware.
cybersecuritynews.com
