ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

ClearFake has expanded a fake CAPTCHA scam into a chain that steals cryptocurrency and credentials while disabling endpoint protection. It turns compromised websites into launchpads, relying on visitors to run a command that appears routine.

The operation begins with injected browser code, blockchain-hosted instructions, and a ClickFix prompt styled as a Google CAPTCHA. After a user follows the steps, a remote loader retrieves and runs a disguised library through WebDAV.

Cisco Talos analysts identified the activity after seeing unusual remote library execution at a Ukrainian government organization in April 2026. They assess the observed attacks were part of a broader theft operation, not one campaign aimed at that organization.

The consequences can extend beyond stolen browser data. One branch installs a crypto stealer that changes copied wallet addresses, while another can provide remote control to an operator. This gives attackers a route from one deceptive webpage to persistent access and financial theft.

Cisco Talos said in a report shared with Cyber Security News (CSN) that it tracked the activity linked to the remote-loader branch as UAT-10820.

ClearFake Deploys Crypto Stealer

In the crypto-stealer branch, the first payload receives instructions to fetch an archive. A legitimate, signed Chrome component inside that archive is abused to load a malicious library placed beside it, a technique called DLL side-loading.

That library launches ZigCryptoStealer and a signed but vulnerable Windows driver. The loader searches for EDR products and sends matching process identifiers to the driver, which can force them to stop.

This is a bring-your-own-vulnerable-driver, or BYOVD, attack. A driver works deep inside Windows, so process killing can undermine protections that watch the device. Similar driver attacks against EDR tools show why signed code alone cannot be treated as safe.

With defenses weakened, ZigCryptoStealer monitors the clipboard for cryptocurrency addresses. It can replace a copied address with one controlled by the attacker, potentially redirecting a payment without an obvious warning to the victim.

The malware also uses a blockchain contract to obtain changing command infrastructure. That approach, known as EtherHiding, allows operators to update where the stealer communicates without changing the code delivered to an infected computer.

This lets attackers change campaigns quickly and keep malicious content away from their primary delivery infrastructure. Earlier Amatera stealer web campaigns illustrate how ClearFake operators have repeatedly paired hacked sites with fake verification screens.

From Fake CAPTCHA to Control

The delivery chain starts when attackers compromise a website and inject JavaScript through a malicious Cloudflare Worker. The script checks the visitor environment and retrieves more code from BNB Smart Chain before covering the page with a convincing verification prompt.

The prompt instructs Windows visitors to open the Run dialog, paste clipboard content, and press Enter. That action launches a command that accesses a remote WebDAV path and calls rundll32, a legitimate Windows utility, to execute a library export identified only by a number.

This design shifts the crucial execution step to the victim, avoiding the need for a browser exploit. The approach matches a ClickFix WebDAV delivery technique that uses trusted Windows components to load remote malware while obscuring the command’s purpose.

A separate branch uses the same general WebDAV pattern but eventually runs a PowerShell script that installs an unauthorized remote-access client. It hides the client interface, connects to an attacker gateway, and creates a task that starts at logon.

That remote-access capability raises the stakes. Automated theft can collect passwords, session data, wallet material, and selected files, while a human operator may then browse the desktop, transfer files, run commands, or deploy more malware.

Related fake CAPTCHA malware attacks show the same social-engineering model remains effective across changing loaders.

Organizations should teach staff that legitimate CAPTCHA checks never require opening Run, Terminal, PowerShell, or Command Prompt and pasting a command.

Security teams should investigate unusual WebDAV traffic, ordinal-based rundll32 execution, unexpected driver services, and new scheduled tasks, and should use driver blocklists and vulnerable-driver protections.

Indicators of compromise (IoCs):-

Type	Indicator	Description
BNB Smart Chain RPC domain	bsc-testnet-rpc[.]publicnode[.]com	RPC service queried by the initial ClearFake browser script
BNB Smart Chain contract	0x886d310Ac23e05EA705e24E513D19f53793832A9	Initial contract used to retrieve encoded malicious JavaScript
BNB Smart Chain contract	0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff	Windows-specific second-stage contract
BNB Smart Chain contract	0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5	macOS-specific second-stage contract
WebDAV domain	leaguejazire[.]com	Randomized subdomains used for Windows WebDAV delivery
Domain	riyazinikokar[.]xyz	macOS ClickFix request infrastructure
File name	pf.ch	WebDAV-delivered DLL loader
File name	verification.google	WebDAV-delivered DLL loader observed at the Ukrainian organization
Dead-drop URL	hxxps://telegra[.]ph/Functions-04-03	Public page used by the Amatera branch to resolve C2
IPv4 address	145.249.109[.]147:443	Resolved Amatera command-and-control server for the pf.ch branch
IPv4 address	45.150.34[.]2:443	Bootstrap C2 address for the verification.google branch
TLS SNI and Host	github[.]com	Hostname presented by the verification.google Amatera build during C2 communications
SHA-256	279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92	ZIP archive containing the DLL side-loading package
File name	platform_experience_helper.exe	Signed Chrome component abused for DLL side-loading
File name	Secur32.dll	Malicious NativeAOT loader side-loaded by the Chrome component
BNB Smart Chain RPC domain	bsc[.]rpc[.]blxrbdn[.]com	RPC endpoint queried by ZigCryptoStealer
BNB Smart Chain contract	0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468	Contract used by ZigCryptoStealer to obtain C2 configuration
C2 domain	fd[.]gstats-api-contact[.]cc	Historical ZigCryptoStealer contract value
C2 domain	pkg[.]vogueatelier[.]cc	Historical ZigCryptoStealer contract value
C2 domain	kffd3[.]vogueatelier[.]cc	Historical ZigCryptoStealer contract value
C2 domain	kffd3[.]vexlatech[.]cc	Historical ZigCryptoStealer contract value
C2 domain	static[.]quorashift[.]cc	Historical ZigCryptoStealer contract value
C2 domain	lb[.]propertyfind[.]cc	ZigCryptoStealer C2 domain returned during analysis
Driver file name	DCRCVDrv.sys	Signed vulnerable driver used to terminate security processes
Device path	\Device\DCRCVDRV_U	Driver device exposed by DCRCVDrv.sys
SHA-256	643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205	Shellcode payload used to deploy the Go reverse TCP proxy
SHA-256	1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25	Unpacked Go-based reverse TCP proxy executable
WebSocket C2	wss://update[.]dubbedmuch[.]cc/	Hard-coded C2 endpoint for the reverse TCP proxy
PowerShell payload URL	hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js	Secondary PowerShell payload for the verification.google branch
PowerShell download URL	hxxps://phys[.]stunned-amniotic[.]com/hub[.]log	ZIP payload retrieved by the PowerShell installer
SHA-256	bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b	ZIP archive containing the unauthorized remote-access deployment
File name	hypersnap.exe	Renamed remote-access client launched by the PowerShell script
File name	client32.ini	Actor-controlled configuration file for the remote-access client
Remote-access gateway	paternal-angrily[.]com:443	Configured remote-access HTTP gateway
IPv4 address	212.118.56[.]166	IP address resolving from the remote-access gateway during analysis

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.