WordlistLoader Hides Malware Inside Plain English Word Lists

Key points

• Gen Threat Labs researchers discovered WordlistLoader, a new malware delivery tool, in mid-2025.
• WordlistLoader delivers Amatera Stealer, a criminal subscription service that steals passwords, browser data, and cryptocurrency wallet details.
• Amatera has been circulating for just over a year and is now one of the most commonly seen infostealers, according to Gen Threat Labs.
• The loader spreads through hijacked legitimate websites that display fake security prompts tricking visitors into running harmful commands.
• Multiple advanced criminal groups have used Amatera since 2025, and the software is still being actively updated.

Security researchers at Gen Threat Labs have uncovered a clever piece of criminal software called WordlistLoader, which exists purely to sneak a password thief called Amatera Stealer onto victims' computers without triggering alarms.

Amatera Stealer is a type of malware, meaning malicious software, sold on criminal markets as a subscription service. The software vacuums up saved passwords, browser history, cryptocurrency wallet details, and message logs from infected Windows computers. Researchers at Proofpoint noted last year that it grew out of an earlier thief tool called ACR Stealer.

How does the trick with word lists actually work?

Instead of carrying obvious harmful code, WordlistLoader hides its instructions inside what looks like a long, innocent list of everyday English words. A security scanner glancing at the file sees ordinary text, not an attack.

When the software runs, it translates those words back into executable instructions using a secret lookup table of 256 words. The word sitting at position zero in the list equals a particular machine instruction, the word at position 144 equals another, and so on. Gen Threat Labs researcher Vojtěch Krejsa described the process: the loader simply scans the word sequence, finds each word's position in the table, and writes that number into a fresh block of memory, rebuilding the hidden payload piece by piece.

Once that rebuild is complete, WordlistLoader does three more things. It removes monitoring "hooks" that security products quietly insert into Windows to watch for suspicious behaviour. It also disables Event Tracing for Windows, a built-in Microsoft logging system that security tools rely on to see what a program is doing. Finally, it applies several tricks to make automated analysis tools believe the software is harmless.

Only after all of that does it hand control over to Amatera Stealer itself.

How do victims end up infected?

WordlistLoader reaches victims through a method called ClearFake, a network of criminal-controlled websites built on top of real, legitimate sites that criminals have quietly broken into. Visitors see a fake security warning or CAPTCHA prompt, the small "prove you are human" puzzle familiar from online forms.

The fake prompt tells the visitor to copy a command into their computer's run box. Doing so installs the malware. This technique is called ClickFix, and security firm Proofpoint, first reported by Dark Reading, began including it in its awareness training in 2024. Selena Larson, a principal researcher at Proofpoint, says ClickFix has become one of the most popular infection routes across both email and web-based attacks.

Should ordinary users worry?

Anyone who uses a Windows computer and stores passwords or cryptocurrency in their browser should pay attention. If you visited an unfamiliar website recently and saw an unexpected security pop-up asking you to copy and run a command, treat that as a red flag and run a reputable antivirus scan.

Do not copy commands from websites into your computer's run box or terminal unless you know exactly what you are pasting.

Common questions

What is a "malware-as-a-service" tool?

It is criminal software sold or rented to other criminals on a subscription basis, the same business model as legitimate cloud software, but used to steal data.

Why is Amatera getting more popular now?

Law enforcement actions against rival tools, including Lumma Stealer and Rhadamanthys, pushed criminals toward alternatives. Amatera, still actively updated by its creators, has filled part of that gap.