GoKawiilNew WordlistLoader Malware Hides Amatera Infostealer in Plain Text Files
Researchers have identified a new loader tool called WordlistLoader that disguises malicious code as ordinary text files, such as word lists, to slip past security defenses. It's being used in ClickFix-style attacks—where victims are tricked into manually executing commands—to deploy the Amatera infostealer, a malware family that has been rapidly gaining traction among cybercriminals.
GoKawiil's interpretation of the reporting above, not reported fact.
By camouflaging payloads as innocuous text data, attackers can bypass signature-based detection tools that typically flag executable or script files rather than plain text. This technique reflects a broader trend of threat actors refining social-engineering and obfuscation methods to keep pace with improving endpoint defenses, making infostealers like Amatera harder to catch before they exfiltrate credentials and sensitive data.
- WordlistLoader disguises malicious payloads as ordinary text files to evade security scanning.
- The technique is being paired with ClickFix-style social engineering to trick users into executing malware manually.
- Amatera, the infostealer being delivered, is rapidly growing in prevalence among cybercrime campaigns.
Source: darkreading.com, 2026-08-24
Published there as: “Foul Language: WordlistLoader Disguises Malware as Ordinary Text”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.