Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential-Stealing Malware
Cisco Talos details ClickFix campaigns abusing fake Google CAPTCHA prompts, WebDAV and BNB Smart Chain to deploy the Amatera infostealer.
Cisco Talos identified a multi-stage campaign, first observed in April 2026 when a Ukrainian government organization executed a disguised DLL named verification.google from a WebDAV path. The chain combines ClearFake JavaScript injected via malicious Cloudflare Workers, EtherHiding payloads stored in BNB Smart Chain contracts, ClickFix social engineering, and WebDAV-hosted DLL loaders to deliver the Amatera (ACR Stealer) infostealer. The Amatera configuration contained over 400 collection entries targeting browsers, messengers, crypto wallets, password managers, FTP and VPN tools, hunting for .kdbx, .p12, .pfx and .pem files. The pf.ch branch deploys ZigCryptoStealer, an EDR-terminating vulnerable driver and Go-based reverse TCP proxies, while the verification.google branch installs NetSupport Manager, supporting moderate-confidence attribution of the UAT-10820 activity to a Russian actor.
- Chain uses compromised sites, ClearFake JavaScript, EtherHiding in BNB Smart Chain contracts, ClickFix prompts, and WebDAV DLL loaders
- Amatera configuration holds 400+ collection entries: browsers, wallets, messengers, password managers, FTP and VPN tools
- pf.ch branch deploys ZigCryptoStealer, an EDR-killing vulnerable driver, and Go reverse TCP proxies
- verification.google branch installs unauthorized NetSupport Manager; Russia-based C2 IP supports UAT-10820 attribution
- Hunt rundll32.exe from WebDAV UNC paths invoking pf.ch or verification.google by ordinal
- ATT&CK
- T1189 Drive-by CompromiseT1204.002 Malicious FileT1218.011 Rundll32T1115 Clipboard DataT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Cisco Talos
- Threat actors
- UAT-10820
- Malware
- AmateraZigCryptoStealer
- Organizations
- BNB Smart Chain
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | leaguejazire.com | opens a WebDAV UNC path hosted on a randomized subdomain of leaguejazire[.]com , then launches the pf.ch loader through rundll32.exe usi |
From the original article
3 min read at gbhackers.com
A multi-stage malware operation that combines fake Google CAPTCHA prompts, WebDAV-hosted DLL execution, malicious Cloudflare Workers and BNB Smart Chain smart contracts to deploy the Amatera information stealer. The activity was first identified in April 2026 after a Ukrainian government organization executed a disguised DLL named “verification. google” from a WebDAV path using the 32-bit rundll32.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.