All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
Security researchers have found a new malware loader that can hide in plain sight, disguising malicious code as ordinary English words rather than suspicious files or conventional-looking code.[1]
Even more concerning is that you don’t necessarily have to click on a suspicious link or download an unknown file to fall prey. You could simply be browsing a legitimate website when a pop-up — such as a CAPTCHA — tricks you into copying a command, pasting it into your computer, and hitting Enter.
Called WordlistLoader, this malware loader can disguise malicious code as plain English text and deliver it through ClickFix-style attacks by compromising legitimate websites.
And just like that, all your information, including passwords, saved logins, crypto wallet credentials, and private chat history, could end up in the hands of a cybercriminal.
Here’s everything you should know about WordlistLoader and how you can stay safe.
Researchers at Gen Threat Labs have found a new malware loader called WordlistLoader, which quietly prepares a victim’s computer to load the actual malware, which in this case is an information stealer called Amatera.
As per Proofpoint, Amatera has been around for over a year. Once inside a system, it can scoop up a wide range of information, including saved passwords, chat logs, browser data and cookies, cryptocurrency wallet credentials, and even message history.
This is bad enough on its own, but attackers could also use this stolen information to carry out highly targeted phishing attacks, tricking you into revealing even more sensitive information or committing financial fraud.
What’s clever about WordlistLoader is that instead of delivering the malware as conventional executable code, it hides the malicious code as ordinary English words that look like harmless text.
Each word in the list represents a specific byte value. When the loader runs, it looks up each word in the list and converts it back into the corresponding byte, rebuilding the malicious code piece by piece. The wordlist contains 256 distinct words, with each word mapped to a byte value.
The entire attack is delivered through a ClickFix-style delivery method associated with a threat cluster identified as ClearFake.
Under this technique, attackers compromise a legitimate and otherwise trustworthy website and plant fake pop-ups. These can be disguised as CAPTCHA challenges designed to trick users into taking an action that ultimately executes the malicious command.
/images/2026/08/27/wordlistloader-malware-plain-english_01.jpg)
Interestingly, the website itself suggests a fix to the issue, hence the name ClickFix. This often involves copying and pasting a command into Windows Run or PowerShell. However, that command is actually malicious code designed to infect your system.
Most users don’t realize that they’re not entering a harmless search term or troubleshooting instruction, but instead pasting an executable malicious command.
Because security-scanning tools see what appears to be innocent text rather than executable code, the malware can potentially slip past detection.
Also, security software generally looks for malicious files that are downloaded and executed from the internet. However, when a human manually copies and pastes a command into a built-in Windows tool, it can potentially bypass some of these security defenses.
However, that’s not the only job of WordlistLoader.
Since this attack relies heavily on social engineering and tricking you into performing an action that can compromise your system, you can avoid it by staying vigilant. Here are some steps you can take.
WordlistLoader is a particularly sneaky threat because it can disguise malicious code as harmless English text and use legitimate-looking websites to trick you into executing it.
Once inside your system, the Amatera information stealer can harvest passwords, browser data, cookies, crypto wallet credentials, and message history, putting your accounts and incredibly sensitive information at risk.
The good news is that this attack is relatively easy to avoid with a little caution. Never copy and paste commands into Windows Run or PowerShell when prompted by a website, and use security tools such as an updated antivirus and identity theft protection service to keep your information safe.
Our #1 rated antivirus that scores 18/18 on AV-TEST across Windows, macOS, and Android, verified across multiple test rounds
Passed every malware, drive-by download, and phishing detection test we ran, quarantining threats automatically
Backed by a 100% Virus Protection Promise: if Norton can't remove a virus, you get your money back
/images/2023/06/15/guardio_review.jpg)
/images/2022/09/08/malwarebytes-review.jpg)
/images/2026/08/27/wordlistloader-malware-plain-english.jpeg)
/images/2026/08/26/children_hands_holding_apple_ipad_with_multiplayer_online_game_minecra_dQXyfjY.jpg)
/images/2026/07/15/crashstealer-mac-infostealer.jpg)
/images/2026/07/14/russian-hacker-routers.jpg)
/images/2026/07/08/netnut-infected-2-million-home-devices.png)
/images/2025/12/10/best-christmas-antivirus-deals.jpg)
/authors/krishi_chowdhary_headshot.jpg){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/03/03/logo-norton-large.png){kind=logo}
/authors/krishi_chowdhary_headshot.jpg)