As reported by The Hacker News, researchers at Gen Digital have uncovered two new loader families — WordlistLoader and SynkLoader — being deployed in active ClearFake campaigns to deliver Amatera Stealer (also tracked as ACR Stealer or AcridRain Stealer). The campaign leverages the ClickFix (FakeCaptcha) technique, blockchain-hosted payload staging (EtherHiding), and legitimate CDN abuse to create a multi-layered delivery pipeline that is proving remarkably resilient to takedown.
Why This Matters: The Infrastructure Compounds
The most significant development here is not any single component but the convergence of three evasion techniques into one chain. Each layer addresses a weakness in the previous one:
pushd and executed through rundll32.exe avoid writing files to disk, minimizing forensic footprint.When one jsDelivr repository is burned, the blockchain-stored first stage simply swaps in a fresh URL. This self-healing infrastructure means static IOC blocklists will perpetually lag behind the campaign. Defenders relying on URL filtering alone are fighting the last war.
The Execution Chain: Where Defenders Can Intervene
Despite the sophisticated staging, the final execution path on the endpoint is surprisingly conventional. The chain follows a predictable sequence: conhost launches a hidden cmd.exe, which mounts a remote WebDAV share via pushd, then invokes rundll32.exe to load the DLL. This is the campaign's structural weakness — it depends on living-off-the-land binaries that can be monitored and constrained.
The blockchain and CDN layers are designed to defeat network controls. The execution layer is where endpoint controls can still win.
Who Is at Risk
Any organization whose users browse the open web is exposed. The compromised legitimate sites observed — including legal, e-commerce, and infrastructure domains — demonstrate that this is not a targeted attack. It is a volume operation. The end goal of Amatera Stealer is credential and session token exfiltration, and the loaders are positioned to sell initial access to ransomware affiliates, meaning a single user interaction can become a ransomware foothold.
Shield53 Recommendations
Immediate Actions
- Constrain LOLBins: Apply Application Control (WDAC or AppLocker) policies to restrict
rundll32.exefrom loading DLLs from WebDAV paths or UNC shares. At minimum, alert on anyrundll32.exeexecution with a network path argument. - Block WebDAV from user space: Disable the WebDAV Redirector driver (
MRxDAV.sys) on workstations where WebDAV access is not a business requirement. This breaks thepushd-to-WebDAV execution path entirely. - Detect the chain: Deploy EDR correlation rules for the sequence
conhost.exe→cmd.exe(hidden window) →pushd→rundll32.exewith a UNC or HTTP(S) argument. This behavioral pattern is high-fidelity regardless of which loader variant is used. - Monitor clipboard injection: While hard to prevent, EDR solutions that detect PowerShell or cmd execution shortly after clipboard content changes involving Base64 or long command strings can catch the ClickFix handoff.
Strategic Actions
- User awareness: Brief staff that legitimate CAPTCHA verifications never require pasting commands into the Run dialog. This single message disrupts the entire ClickFix vector.
- Network egress hardening: Block outbound WebDAV (port 443 to known WebDAV endpoints) where feasible and monitor for
rundll32making external network connections. - Credential hygiene: Given Amatera Stealer targets credentials and session tokens, enforce MFA on all external-facing services and rotate any sessions that may have been exposed on compromised machines.
The ClickFix technique has been circulating since at least 2024, but the addition of blockchain-hosted staging and CDN abuse represents a maturation that demands a response beyond IOC blocking. The chokepoint remains the endpoint execution chain — defenders who focus detection and prevention there will neutralize the campaign regardless of how the payload is delivered.
