ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.
- ClickFix fake CAPTCHA prompts users to run WebDAV-delivered rundll32 payloads
- ZigCryptoStealer replaces copied wallet addresses via clipboard monitoring
- BYOVD technique uses a signed vulnerable driver to force-kill EDR tools
- EtherHiding fetches command infrastructure from BNB Smart Chain contracts
- Tracked as UAT-10820; first seen at a Ukrainian government organization
- ATT&CK
- T1204.002 Malicious FileT1218.011 Rundll32T1574.002 Hijack Execution Flow: DLL Side-LoadingT1562.001 Impair Defenses: Disable or Modify ToolsT1115 Clipboard Data
- Vendors
- Cisco Talos
- Products
- Cloudflare Workers
- Threat actors
- UAT-10820
- Organizations
- Cisco Talos
- Countries
- Ukraine
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bsc.rpc.blxrbdn.com | e-loaded by the Chrome component BNB Smart Chain RPC domain bsc[.]rpc[.]blxrbdn[.]com RPC endpoint queried by ZigCryptoStealer BNB Smart Ch |
| domain | bsc-testnet-rpc.publicnode.com | Cs):- Type Indicator Description BNB Smart Chain RPC domain bsc-testnet-rpc[.]publicnode[.]com RPC service queried by the initial ClearFake browser sc |
| domain | fd.gstats-api-contact.cc | ed by ZigCryptoStealer to obtain C2 configuration C2 domain fd[.]gstats-api-contact[.]cc Historical ZigCryptoStealer contract value C2 domain pk |
| domain | kffd3.vexlatech.cc | r[.]cc Historical ZigCryptoStealer contract value C2 domain kffd3[.]vexlatech[.]cc Historical ZigCryptoStealer contract value C2 domain st |
| domain | kffd3.vogueatelier.cc | r[.]cc Historical ZigCryptoStealer contract value C2 domain kffd3[.]vogueatelier[.]cc Historical ZigCryptoStealer contract value C2 domain kf |
| domain | kr.cedar2glanz.ru | nt for the reverse TCP proxy PowerShell payload URL hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js Secondary PowerShell payload for the verific |
| domain | lb.propertyfind.cc | t[.]cc Historical ZigCryptoStealer contract value C2 domain lb[.]propertyfind[.]cc ZigCryptoStealer C2 domain returned during analysis Dri |
| domain | leaguejazire.com | 1fEb11A5 macOS-specific second-stage contract WebDAV domain leaguejazire[.]com Randomized subdomains used for Windows WebDAV delivery Do |
| domain | paternal-angrily.com | ion file for the remote-access client Remote-access gateway paternal-angrily[.]com:443 Configured remote-access HTTP gateway IPv4 address 21 |
| domain | phys.stunned-amniotic.com | verification.google branch PowerShell download URL hxxps://phys[.]stunned-amniotic[.]com/hub[.]log ZIP payload retrieved by the PowerShell insta |
| domain | pkg.vogueatelier.cc | t[.]cc Historical ZigCryptoStealer contract value C2 domain pkg[.]vogueatelier[.]cc Historical ZigCryptoStealer contract value C2 domain kf |
| domain | riyazinikokar.xyz | ndomized subdomains used for Windows WebDAV delivery Domain riyazinikokar[.]xyz macOS ClickFix request infrastructure File name pf.ch Web |
| domain | static.quorashift.cc | h[.]cc Historical ZigCryptoStealer contract value C2 domain static[.]quorashift[.]cc Historical ZigCryptoStealer contract value C2 domain lb |
| domain | telegra.ph | bserved at the Ukrainian organization Dead-drop URL hxxps://telegra[.]ph/Functions-04-03 Public page used by the Amatera branch to |
| domain | update.dubbedmuch.cc | ed Go-based reverse TCP proxy executable WebSocket C2 wss://update[.]dubbedmuch[.]cc/ Hard-coded C2 endpoint for the reverse TCP proxy Power |
| ipv4 | 145.249.109.147 | page used by the Amatera branch to resolve C2 IPv4 address 145.249.109[.]147:443 Resolved Amatera command-and-control server for the p |
| ipv4 | 212.118.56.166 | ]com:443 Configured remote-access HTTP gateway IPv4 address 212.118.56[.]166 IP address resolving from the remote-access gateway durin |
| ipv4 | 45.150.34.2 | ommand-and-control server for the pf.ch branch IPv4 address 45.150.34[.]2:443 Bootstrap C2 address for the verification.google bran |
| sha256 | 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 | ode payload used to deploy the Go reverse TCP proxy SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25 Unpacked Go-based reverse TCP proxy executable WebSocket C2 |
| sha256 | 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 | ation.google Amatera build during C2 communications SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 ZIP archive containing the DLL side-loading package File na |
| sha256 | 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 | ce\DCRCVDRV_U Driver device exposed by DCRCVDrv.sys SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205 Shellcode payload used to deploy the Go reverse TCP proxy S |
| sha256 | bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b | g ZIP payload retrieved by the PowerShell installer SHA-256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b ZIP archive containing the unauthorized remote-access deplo |
| url | https://kr.cedar2glanz.ru/jewel.js | 2 endpoint for the reverse TCP proxy PowerShell payload URL hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js Secondary PowerShell payload for the verification.goo |
| url | https://phys.stunned-amniotic.com/hub.log | for the verification.google branch PowerShell download URL hxxps://phys[.]stunned-amniotic[.]com/hub[.]log ZIP payload retrieved by the PowerShell installer SHA |
| url | https://telegra.ph/Functions-04-03 | loader observed at the Ukrainian organization Dead-drop URL hxxps://telegra[.]ph/Functions-04-03 Public page used by the Amatera branch to resolve C2 IPv4 |
From the original article
5 min read at cybersecuritynews.com
ClearFake has expanded a fake CAPTCHA scam into a chain that steals cryptocurrency and credentials while disabling endpoint protection. It turns compromised websites into launchpads, relying on visitors to run a command that appears routine. The operation begins with injected browser code, blockchain-hosted instructions, and a ClickFix prompt styled as a Google CAPTCHA.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.