ClearFake Delivers Crypto Stealer, Disables EDR With Vulnerable Driver

Key Takeaways

• ClearFake has evolved its social engineering tactics, now leveraging compromised websites and deceptive CAPTCHA prompts to initiate sophisticated infection chains.
• The threat actor delivers cryptocurrency stealers and remote access tools, significantly increasing the risk of financial fraud and persistent system compromise.
• A critical component of the attack involves the use of a legitimate but vulnerable Windows driver to disable Endpoint Detection and Response (EDR) solutions, bypassing crucial security layers.
• The attack chain relies heavily on user interaction, specifically tricking victims into executing a seemingly innocuous command that initiates the malware download via WebDAV.
• Organizations and individuals should enhance security awareness training and implement robust technical controls, including driver blocklists, to mitigate the risk of these advanced attacks.

ClearFake Evolves Attack Chain, Disables EDR to Steal Crypto

The ClearFake threat group has significantly advanced its operations, transforming a deceptive CAPTCHA scam into a multi-stage attack designed to steal cryptocurrency and credentials while actively neutralizing endpoint security measures. This sophisticated campaign exploits legitimate websites, converting them into initial access points, and relies on user interaction to execute malicious commands under the guise of routine verification processes.

The initial phase of the attack involves injecting malicious browser code and leveraging blockchain-hosted instructions. Victims encounter a convincing “ClickFix” prompt, visually mimicking a Google CAPTCHA. Should a user follow these instructions, a remote loader is activated, which then fetches and executes a disguised library via WebDAV.

Analysts at Cisco Talos said in a report that they first identified this activity in April 2026, observing unusual remote library execution within a Ukrainian government organization. Their assessment indicates that these incidents are part of a broader, ongoing theft operation rather than a targeted campaign against a single entity.

The consequences of a successful ClearFake compromise extend beyond mere browser data theft. One variant of the attack deploys a crypto stealer designed to covertly alter cryptocurrency wallet addresses copied to the clipboard, effectively redirecting funds to the attacker. Another branch establishes remote control capabilities, providing threat actors with persistent access and a direct route to financial exploitation from an initial deceptive webpage interaction.

Crypto Stealer Branch Leverages Vulnerable Driver

Within the crypto-stealer branch, the initial payload retrieves an archive containing a legitimate, signed Chrome component. This component is then exploited via DLL side-loading to load a co-located malicious library. This technique allows the attacker to bypass detection by leveraging a trusted application’s signature.

The malicious library subsequently deploys ZigCryptoStealer alongside a signed but vulnerable Windows driver. The loader actively scans for installed EDR products, transmitting identified process IDs to the driver. This driver possesses the capability to forcibly terminate these security processes, effectively disabling endpoint protection. This tactic represents a “bring-your-own-vulnerable-driver” (BYOVD) attack, where a legitimate but flawed driver is exploited to gain deep system access and undermine security mechanisms. The use of signed code in such attacks underscores that code signing alone is insufficient to guarantee safety.

With EDR defenses neutralized, ZigCryptoStealer begins monitoring the victim’s clipboard for cryptocurrency addresses. It can then surreptitiously replace a legitimate copied address with an attacker-controlled one, enabling the redirection of cryptocurrency transactions without the victim’s immediate awareness.

Furthermore, the malware utilizes a blockchain contract to dynamically retrieve command and control (C2) infrastructure. This method, known as EtherHiding, allows the operators to update C2 communication points without altering the core malware code delivered to infected systems. This agility enables rapid campaign adjustments and helps conceal malicious content from traditional detection mechanisms. Previous Amatera stealer campaigns have demonstrated similar patterns of combining compromised websites with fake verification prompts.

From Deceptive CAPTCHA to System Control

The infection chain commences when attackers compromise a website and inject JavaScript, often through a malicious Cloudflare Worker. This script analyzes the visitor’s environment, retrieves additional code from the BNB Smart Chain, and then overlays the webpage with a highly convincing verification prompt.

This prompt instructs Windows users to open the “Run” dialog, paste clipboard content, and press Enter. This seemingly benign action executes a command that accesses a remote WebDAV path and invokes rundll32, a legitimate Windows utility, to execute a specific library export identified only by an ordinal number. This design strategically offloads the critical execution step to the victim, circumventing the need for a browser-based exploit. This approach aligns with the “ClickFix WebDAV” delivery technique, which leverages trusted Windows components to load remote malware while obscuring its true malicious intent.

A separate branch of the ClearFake operation follows a similar WebDAV delivery model but ultimately executes a PowerShell script that installs an unauthorized remote-access client. This client operates stealthily, hiding its interface, connecting to an attacker-controlled gateway, and establishing a persistent task that activates upon system logon. This remote-access capability significantly elevates the threat, allowing for not only automated data exfiltration—including passwords, session data, wallet information, and selected files—but also enabling human operators to directly interact with the desktop, transfer additional files, execute commands, and deploy further malware. The persistent effectiveness of fake CAPTCHA social engineering across various malware loaders highlights its continued danger.

What You Should Do

• Educate Users: Emphasize to all staff that legitimate CAPTCHA verification processes will never require opening system utilities like Run, Terminal, PowerShell, or Command Prompt and pasting commands. Any such prompt should be treated as highly suspicious.
• Monitor Network Traffic: Security teams should actively monitor for unusual WebDAV traffic, especially connections to unfamiliar or suspicious remote paths.
• Detect Abnormal Process Execution: Investigate instances of rundll32 executing libraries via ordinal numbers, as this is a common obfuscation technique used by ClearFake and similar threats.
• Implement Driver Blocklists: Utilize driver blocklists and vulnerable-driver protection mechanisms to prevent the loading of known malicious or vulnerable drivers that attackers exploit to disable security tools.
• Audit Scheduled Tasks: Regularly review and audit newly created or modified scheduled tasks on endpoints, as persistent remote access clients often establish themselves this way.
• Enhance EDR and Antivirus: Ensure EDR and antivirus solutions are up-to-date and configured for maximum protection, including behavioral analysis and exploit prevention.
• Regular Backups: Maintain regular, secure, and offline backups of critical data to facilitate recovery in the event of a successful compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.