ClearFake has initiated a sophisticated scheme that not only targets cryptocurrency and credentials but also disables endpoint protection systems. By compromising websites, it converts them into platforms for attack, tricking users into executing what seems like a harmless command.
Mechanism of the Attack
The attack begins with the injection of browser code and blockchain-hosted instructions, presented as a Google CAPTCHA through a ClickFix prompt. When users comply, a remote loader retrieves a concealed library via WebDAV.
Cisco Talos researchers detected this activity after observing remote library execution at a Ukrainian government office in April 2026. This was found to be part of a larger theft operation, not an isolated incident.
Impact of the Crypto Stealer
The consequences of these attacks are significant. The crypto stealer modifies copied wallet addresses, redirecting funds to attackers. It also allows remote access, offering a pathway from a deceptive page to persistent control and monetary theft.
Cisco Talos reported that this activity, connected to a remote-loader branch called UAT-10820, represents a serious threat. The crypto-stealer branch initially receives instructions to download an archive, where a signed Chrome component is manipulated to load a malicious library using DLL side-loading techniques.
Technical Details and Defense Measures
This attack employs a vulnerable Windows driver to disable EDR tools, a tactic known as BYOVD (bring-your-own-vulnerable-driver). This approach undermines device protection by stopping key processes.
The malware, ZigCryptoStealer, monitors clipboard activities for cryptocurrency addresses, replacing them with addresses controlled by attackers. It uses a blockchain contract to dynamically alter its command infrastructure, enabling rapid campaign changes while maintaining malicious operations away from primary delivery systems.
The attack starts by compromising a website and injecting JavaScript through a rogue Cloudflare Worker. This script checks a visitor’s environment, retrieves additional code from BNB Smart Chain, and presents a verification prompt.
From Deception to Control
The prompt instructs users to open the Run dialog and execute a command, accessing a remote WebDAV path to execute a library export. This method bypasses the need for a browser exploit, aligning with the ClickFix WebDAV delivery tactic.
A parallel branch follows a similar WebDAV pattern but culminates in a PowerShell script installation, setting up an unauthorized remote-access client. This grants attackers the ability to collect sensitive information and execute commands, raising the stakes for potential victims.
Organizations should educate their staff that legitimate CAPTCHA checks do not require executing commands via Run, Terminal, PowerShell, or Command Prompt. Security teams should scrutinize unusual WebDAV traffic, unexpected driver services, and new scheduled tasks, while employing driver blocklists and protections against vulnerable drivers.
