threat-intel
Foul Language: WordlistLoader Disguises Malware as Ordinary Text
High
Summary
A new malware loader called WordlistLoader is being used to deliver the Amatera infostealer, primarily through ClickFix-style campaigns. WordlistLoader disguises malicious code using lists of ordinary English words, allowing it to evade security controls and deliver the stealer. Amatera, a rapidly growing infostealer, has been actively developed and used by advanced cybercrime actors since 2025, and is under continuous development to improve its stealth capabilities.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data