Plain English Words Used to Hide Windows Malware

In a currently active malware campaign, hackers are now hiding Windows malware inside lists of plain English words.

Discovered in the wild by Gen Threat Labs, the technique has been dubbed WordlistLoader.

The sophisticate technique is being used as part of Amatera Stealer, and of the most prevalent infostealers, according to the researchers.

It's distributed using the extremely effective fake CAPTCHA social engineering technique, where a website is hijacked to show a fake CAPTCHA that requests a user to copy and paste and then run a command in their terminal or command line.

Most people aren't familiar with the terminal and will instinctively do as instructed, since that's what CAPTCHAs have trained them to do.

macOS has introduced a prompt to warn about such an attack, but ultimately it's impossible to fully prevent unless the terminal is completely disabled.

Windows users are instructed to paste the command into the Windows Run dialog box, a favorite of scammers the world over.

From there, the innocuous-seeming word list is downloaded containing the malware payload and run.

The point of storing the malware inside a wordlist like that is to obfuscate it from researchers and antivirus software. They will just see a harmless list of text instead of a deadly virus.

Previously, it was also discovered that hackers have been hiding malware inside PNG and SVG images, and now even emojis in order to obfuscate their payload. At this point, it seems like anything containing data could be hiding malware.

Malware obfuscation techniques continue to get more and more advanced, but the method of infection is still tried-and-true social engineering. It's important to remember to never copy and paste commands into your command line, terminal, or Windows Run dialog unless you know exactly what they do.

If you have a friend or relative that might be at risk of falling for one of these social engineering attacks, it might be beneficial to disable these features outright, since most people don't really use them anyway.

Beyond that, always keep your OS updated. Never assume any file is inherently safe: media files and text have long been known to contain potential vulnerabilities.