# ClickFix Is Growing Up: Two New Loaders Show the Technique Has Found Its Business Model
The fake CAPTCHA that tells you to paste something into your terminal has been around long enough that you'd think users would recognize it. They don't. And now two newly documented malware families — WordlistLoader and SynkLoader — reveal that the technique has matured from a novelty into a professionalized access pipeline with ransomware groups waiting at the other end.
Researchers at Gen Digital published findings on both loaders this week, and the details are worth sitting with, because what's happening here isn't just another malware discovery. It's a window into how the underground market has industrialized the hand-off between initial compromise and data extortion.
## How WordlistLoader Gets Its Name — and Its Access
WordlistLoader is delivered through ClearFake campaigns, a well-documented infection chain that compromises legitimate websites and overlays them with fake browser update prompts. The twist the attackers are now leaning on is ClickFix — also called FakeCaptcha — which presents victims with a CAPTCHA-style dialog that instructs them to press Win+R, paste a command, and hit Enter. That command, already loaded into their clipboard by the malicious page, fetches and executes WordlistLoader.
The name "WordlistLoader" almost certainly reflects its internal tooling — these operators are likely running credential-stuffing operations in parallel, using wordlists to attack accounts while the stealer handles fresh credential harvests. The payload it drops is Amatera Stealer, sold under several aliases including ACR Stealer and AcridRain Stealer, a commodity infostealer that's been circulating on dark web forums since at least 2023. Amatera targets browser-stored credentials, cryptocurrency wallets, session cookies, and autofill data — the full kit for account takeover.
What's notable is the delivery mechanism more than the payload. ClickFix works because it bypasses almost every traditional browser security control. No malicious email attachment to filter, no drive-by download to detect. The user is the execution engine. They copy, they paste, they confirm. By the time any EDR sees activity worth flagging, the command has already fired.
## SynkLoader Takes a Different Path to the Same Destination
SynkLoader operates through phishing — more traditional, but the researchers note it's targeting Windows credential material directly. The implication from Gen Digital's reporting is that SynkLoader is functioning as an access broker tool: it harvests passwords and likely packages that access for sale to ransomware affiliates rather than deploying ransomware itself.
This separation of roles is key to understanding modern ransomware economics. The groups that run ransomware-as-a-service operations don't want to handle the messy, high-exposure work of initial compromise. They buy access in bulk from specialists. SynkLoader's operators appear to be building that supply.
The loader-to-ransomware pipeline has become remarkably efficient. An operator runs a phishing campaign, harvests credentials, validates which ones open doors to corporate environments, and lists that access on underground forums — sometimes within 24 to 48 hours of infection. A ransomware affiliate buys the access, moves laterally, deploys, and encrypts. Two different criminal operations, one victim.
## What the ClickFix Surge Is Telling Defenders
ClickFix has seen a significant uptick in adoption across multiple threat actor groups over the past year. What started as an occasional gimmick is now documented in campaigns tied to initial access brokers, nation-state adjacent actors, and commodity malware distributors. The technique succeeds for a specific reason that defenders should internalize: it reframes the malicious action as a user-initiated troubleshooting step.
The dialog doesn't say "run this malware." It says "to verify you're human, press Win+R and paste this code." Or it says "your browser is outdated, fix it by running this update command." The social engineering preys on help-desk conditioning — users who have been trained that IT sometimes asks them to run commands to fix problems.
Several indicators defenders should monitor:
mshta.exe, wscript.exe, or powershell.exe spawned from explorer.exe — a classic sign of something pasted into a Run dialogThe harder fix is organizational. Users need to understand that no legitimate website will ask them to run a terminal command. Not as a CAPTCHA. Not as a browser fix. Not as anything. If security awareness training isn't explicitly addressing ClickFix-style lures, it has a gap.
---
## HackWire Analysis
The emergence of WordlistLoader and SynkLoader as documented, named families tells us something the raw technique count doesn't: this is now infrastructure, not improvisation.
ClickFix's rise mirrors what happened with macro-based delivery a decade ago. Attackers discovered that asking users to "enable content" was more reliable than finding a zero-day. Security vendors caught up, Microsoft eventually disabled macros by default, and the technique declined. We're in the early-middle of that same arc with ClickFix. The difference is that the barrier to enforcement here is harder — you can't just flip a registry key to stop users from using their Run dialog.
What Gen Digital's findings highlight, without quite saying it plainly, is the commoditization of the access broker layer. SynkLoader being positioned as a ransomware feeder isn't incidental — it reflects a deliberate market decision. The operators running these campaigns have done the math and concluded that selling access is more profitable, less risky, and more scalable than deploying ransomware themselves. That's a rational economic choice. It also means we should expect more loaders purpose-built for this hand-off model.
The Amatera/ACR Stealer payload on the WordlistLoader side is worth watching too. This stealer family has been quietly rebranded multiple times — AcridRain to ACR to Amatera — which typically signals that the authors are either evading AV signatures or repositioning for new buyers. Multiple active aliases for a single codebase often means the malware is being resold or licensed to different operators running independent campaigns. That distribution model increases the victim surface considerably.
For defenders, the practical takeaway is that endpoint telemetry covering clipboard-to-process chains and Run dialog execution should be mandatory, not optional. These aren't exotic forensics artifacts. They're log entries. If you're not looking at them, you're flying blind through the attack vector that's currently getting the most development investment from the criminal side.
— HackWire Editorial
---
## Related Coverage