WordlistLoader Hides Malware Inside Plain English Word Lists
A new delivery tool for a fast-growing password thief disguises harmful code as ordinary text, making it harder for security software to spot the infection before it takes hold.
Key points
- Gen Threat Labs researchers discovered WordlistLoader, a new malware delivery tool, in mid-2025.
- WordlistLoader delivers Amatera Stealer, a criminal subscription service that steals passwords, browser sessions, and cryptocurrency wallet details.
- Amatera has been circulating for just over a year and is now one of the most commonly seen infostealers, according to Gen Threat Labs.
- The loader spreads through hijacked legitimate websites that display fake security prompts tricking visitors into running harmful commands.
- Multiple advanced criminal groups have used Amatera since 2025, and the software is still being actively updated.
Security researchers at Gen Threat Labs have uncovered a piece of criminal software called WordlistLoader, which exists purely to sneak a password thief called Amatera Stealer onto victims' computers without triggering alarms.
Amatera Stealer is malicious software sold on criminal markets as a subscription service. It vacuums up saved passwords, cryptocurrency wallet details, and message logs from infected Windows computers. Proofpoint researchers noted last June that it grew out of an earlier tool called ACR Stealer.
How does the trick with word lists actually work?
Instead of carrying obvious harmful code, WordlistLoader hides its instructions inside what looks like a long, innocent list of everyday English words. A security scanner glancing at the file sees ordinary text, not an attack.
When the software runs, it translates those words back into executable instructions using a lookup table of 256 words. The word at position zero equals a particular machine instruction, the word at position 144 equals another. Gen Threat Labs researcher Vojtěch Krejsa described it: the loader scans the word sequence, finds each word's position in the table, and writes that number into a fresh block of memory, rebuilding the hidden payload piece by piece.
Once that rebuild is complete, WordlistLoader does three more things. Monitoring "hooks" that security products quietly insert into Windows get stripped out. Event Tracing for Windows, a built-in Microsoft logging system security tools rely on to see what a program is doing, gets disabled. Several anti-analysis tricks then convince automated tools the software is harmless.
Only after all of that does it hand control over to Amatera Stealer itself. It's a tidy, layered defence-stripping sequence, and that's exactly what makes it worth watching.
How do victims end up infected?
WordlistLoader reaches victims through ClearFake, a network of criminal-controlled websites built on top of real, legitimate sites that criminals have quietly broken into. Visitors see a fake CAPTCHA prompt, the small "prove you are human" puzzle familiar from online forms.
The fake prompt tells visitors to copy a command into their computer's run box. That's ClickFix, a social-engineering technique Proofpoint first included in its own ZenGuide awareness training in 2024. We covered a ClickFix network operating at scale in our 5 August story on fake Mac installers. Selena Larson, principal threat researcher at Proofpoint, told Dark Reading that ClickFix is now among the most popular delivery methods across both email and web-based attacks.
Larson also said law enforcement actions against StealC and Lumma Stealer have pushed criminals toward alternatives, with Amatera filling part of that gap.
Should ordinary users worry?
Anyone who stores passwords or cryptocurrency in their browser should pay attention. If you visited an unfamiliar website recently and saw an unexpected security pop-up asking you to copy and run a command, treat that as a red flag and run a reputable antivirus scan.
Don't copy commands from websites into your computer's run box or terminal unless you know exactly what you're pasting.
Common questions
What is a "malware-as-a-service" tool?
It's criminal software sold or rented on a subscription basis, the same business model as legitimate cloud software, but used to steal data.
Why is Amatera getting more popular now?
Law enforcement actions against rival tools pushed criminals toward alternatives. Amatera, still actively updated by its creators, has filled part of that gap.
