HIGH Malware #Credential Theft #Cryptocurrency Theft

ClearFake WebDAV Delivers Stealers & RATs to Ukrainian Gov

2026-09-08 12:29 UTC 4 min read Runtime Rebel Intel

Primary source: blog.talosintelligence.com

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: Cybercriminals deploy Amatera and ZigCryptoStealer, compromising credentials and cryptocurrency wallets.
Affected systems: Users interacting with compromised websites via Cloudflare Workers and WebDAV execution.
Remediation: Enhance endpoint detection and response capabilities to detect malicious DLL execution.

ClearFake WebDAV Infection Chain Leverages Cloudflare Workers for Stealer Deployment

Runtime Rebel is tracking a sophisticated ClearFake WebDAV infection chain that is actively deploying a variety of malware, including the Amatera stealer, ZigCryptoStealer, and unauthorized instances of NetSupport Manager. This multi-stage attack utilizes malicious Cloudflare Workers and the BNB Smart Chain for command and control (C2) infrastructure, demonstrating a growing trend of adversaries exploiting decentralized platforms for stealth and resilience. The campaign was initially detected in April 2026, targeting a Ukrainian government organization, and has since revealed a broader operation focused on cryptocurrency and credentials theft, as detailed by Cisco Talos.

Technical Analysis of the ClearFake WebDAV Chain

The investigation began following the observation of a DLL named “verification.google” executing from a WebDAV UNC path within a Ukrainian government organization’s telemetry in April 2026. This initial lead uncovered two parallel infection chains, both leveraging WebDAV for malicious DLL execution via rundll32.exe. While the initial trigger for the “verification.google” execution remains unconfirmed, Talos successfully reconstructed the pf.ch loader’s full delivery sequence, which is assessed to be highly similar to the former.

The pf.ch branch typically initiates from a compromised website, where a malicious Cloudflare Worker injects JavaScript code. This JavaScript then queries a BNB Smart Chain testnet contract (0x886d310Ac23e05EA705e24E513D19f53793832A9) to retrieve the next stage payload. This technique, known as EtherHiding, uses the public blockchain as a bulletproof hosting provider for malicious code. Depending on the victim’s operating system, the JavaScript then presents a fake Google CAPTCHA or ClickFix prompt, tricking users into downloading and executing the Amatera stealer.

Amatera Stealer and Secondary Payloads

The Amatera stealer serves as the primary payload across both identified infection branches. However, the secondary payloads deployed vary based on the specific C2 infrastructure used:

pf.ch branch: The Amatera configuration instructs the download of a DLL side-loading package, which utilizes a signed Chrome component to sideload a malicious NativeAOT DLL (secur32.dll). This DLL then deploys ZigCryptoStealer and incorporates a vulnerable driver to terminate endpoint detection and response (EDR) software. Additionally, a Go-based reverse TCP proxy is deployed as a secondary payload, enhancing attacker control and persistence.
verification.google branch: This branch, tracked by Talos as involving UAT-10820, delivers a PowerShell script designed to install an unauthorized instance of NetSupport Manager. The installed NetSupport Manager remote access tool was configured to communicate with a C2 server using a Russian IP address. Talos assesses with moderate confidence that the verification.google attack branch was conducted by a Russian threat actor.

Prioritizing `Amatera stealer detection` and Mitigation

Organizations, particularly those in critical sectors, must prioritize immediate and comprehensive actions to counter this threat. The use of WebDAV for initial execution, coupled with social engineering tactics via fake CAPTCHAs, highlights the need for a multi-layered defense strategy.

Actionable Recommendations:

Enhance Endpoint Detection and Response (EDR): Implement and configure EDR solutions to detect anomalous WebDAV activity, unusual DLL execution (especially via rundll32.exe), and the loading of known malicious DLLs like secur32.dll. Focus on behavioral detection for process injection and EDR termination attempts.
Implement Network Segmentation and Filtering: Block outbound connections to known malicious C2 infrastructure and monitor for connections to unusual or suspicious IP addresses, particularly those associated with NetSupport Manager C2 mitigation efforts.
User Awareness Training: Conduct regular security awareness training to educate users about social engineering tactics, including fake CAPTCHA prompts and unsolicited software downloads. Emphasize verification of download sources and caution against executing untrusted files.
Application Whitelisting: Restrict unauthorized applications from running on endpoints. This can help prevent the execution of malicious DLLs and unauthorized remote access tools like NetSupport Manager.
Multi-Factor Authentication (MFA): Enforce MFA across all services, especially for accounts with access to sensitive data or cryptocurrency wallets, to mitigate the impact of stolen credentials.
Monitor Cloudflare Workers: Organizations using Cloudflare Workers should regularly review their configurations for any unauthorized or suspicious scripts that could be injecting malicious JavaScript into web content.

While the primary goal of this campaign appears to be financial gain through cryptocurrency and credential theft, the involvement of a suspected Russian threat actor in one branch targeting a Ukrainian government entity underscores the broader geopolitical implications and the evolving nature of cyber warfare. Continuous vigilance and proactive defense measures are essential.

#Credential Theft #Cryptocurrency Theft

X/Twitter LinkedIn Reddit HN

← Back to Articles