WordlistLoader Malware Hides Shellcode in Ordinary English Words

Researchers from Gen Threat Labs have identified a new malware loader called WordlistLoader that disguises malicious shellcode as ordinary English text. The loader is primarily used to deploy the Amatera infostealer to Windows machines, marking a sophisticated shift in how threat actors bypass traditional security detections.

According to Gen Threat Labs, WordlistLoader utilizes a build-specific wordlist containing 256 distinct English words. Each word in the list maps to a specific byte value—for example, the word at index 0 decodes to 0x00—allowing the malware to rebuild its executable shellcode from what appears to be a harmless list of words. To further evade detection, the loader includes capabilities to unhook loaded modules and employ anti-emulation and anti-analysis tricks. It specifically bypasses Event Tracing for Windows (ETW) using hardware breakpoints to remain invisible to system monitoring tools.

The Delivery Pipeline

The malware is distributed via the ClearFake threat cluster using "ClickFix" style social engineering. These attacks typically involve compromised websites that present users with fake CAPTCHA lures. Once tricked, users are led to execute malicious commands via the Windows Run dialog, which then triggers the WordlistLoader sequence.

Once the loader successfully executes, it delivers Amatera, an infostealer based on the ACR Stealer. Amatera is designed to harvest sensitive data, specifically targeting browser data, user credentials, and cryptocurrency wallets.

Why It Matters

The use of innocuous English words to hide executable code represents a creative evasion technique that can easily bypass signature-based detection systems, which typically look for known malicious byte sequences rather than lists of dictionary words. When combined with the high success rate of ClickFix social engineering, the risk of successful infection increases significantly.

This trend reflects a broader shift in the threat landscape. As law enforcement disrupts major infostealer operations and security awareness improves, attackers are migrating to newer strains like Amatera and developing more complex obfuscation methods to maintain their access to sensitive financial and personal data.

What's Next

Security professionals are urged to update their defenses to recognize the patterns of ClickFix-style lures. Organizations should incorporate ClickFix scenarios into their security training to mitigate the risk of user-driven execution. Analysts will continue to monitor the ClearFake cluster to determine if WordlistLoader is being adapted for other malware families beyond Amatera.