ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos investigated a multi-stage malware infection chain that begins with WebDAV-based DLL execution via the Windows rundll32.exe process. The infection chain uses a Cloudflare Worker to inject JavaScript code stored on the BNB Smart Chain blockchain, a technique called EtherHiding, to deliver payloads. Victims are tricked by a fake Google CAPTCHA prompt to execute commands that launch DLL loaders named "verification.google" and "pf.ch". The "pf.ch" loader deploys ZigCryptoStealer and a Go-based reverse proxy, while the "verification.google" loader installs an unauthorized instance of NetSupport Manager with a C2 server IP linked to Russia, indicating a likely Russian threat actor. The initial detection was from endpoint telemetry at a Ukrainian government organization in April 2026. Multiple infection chains delivering Amatera stealer exist, but no direct infrastructure links were found between them. The attack leverages WebDAV UNC paths, DLL sideloading, vulnerable drivers to disable endpoint detection and response (EDR) software, and blockchain-based code hosting to evade detection and maintain persistence.

The infection chain enables credential theft and cryptocurrency theft through the Amatera stealer and secondary payloads. The use of NetSupport Manager allows remote access and control of infected systems. The sophisticated multi-stage delivery and evasion techniques increase the difficulty of detection and mitigation. The presence of a C2 server IP linked to Russia suggests potential geopolitical implications. The infection was observed in a Ukrainian government organization but is assessed as not specifically targeted, indicating a broader campaign. The overall impact includes unauthorized access, data theft, and potential further compromise of victim systems.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Mitigation should focus on detection and prevention of the infection chain by monitoring for WebDAV-based DLL execution, suspicious rundll32.exe activity, and unusual network connections to known C2 servers. Organizations should be aware of the use of fake CAPTCHA prompts and blockchain-based code hosting as part of the infection chain. Endpoint detection and response solutions should be updated to detect the Amatera stealer and associated payloads. User education to avoid executing unsolicited commands or prompts is recommended. Since this is not a cloud service, remediation depends on endpoint and network defenses.