#clearfake — Public Fediverse posts

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Indicators extracted from public reporting. Source: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/

Pulse ID: 6aa17392921667b5acca2a74
Pulse Link: https://otx.alienvault.com/pulse/6aa17392921667b5acca2a74
Pulse Author: CyberHunter_NL
Created: 2026-09-09 14:56:18

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ClearFake #CyberSecurity #EDR #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RCE #Talos #bot #CyberHunter_NL

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.

Pulse ID: 6a9ffe054812bce013827753
Pulse Link: https://otx.alienvault.com/pulse/6a9ffe054812bce013827753
Pulse Author: AlienVault
Created: 2026-09-08 12:22:29

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CAPTCHA #ClearFake #Cloud #CyberSecurity #Google #InfoSec #Java #JavaScript #NetSupport #NetSupportManager #OTX #OpenThreatExchange #Password #Proxy #RAT #ReverseProxy #Russia #Word #bot #cryptocurrency #AlienVault

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Indicators extracted from public reporting. Source: https://raw.githubusercontent.com/Cisco-Talos/IOCs/refs/heads/main/2026/09/clearfake-webdav-infection-chain.txt

Pulse ID: 6a9ff7e7bd8d139e1855cdf6
Pulse Link: https://otx.alienvault.com/pulse/6a9ff7e7bd8d139e1855cdf6
Pulse Author: CyberHunter_NL
Created: 2026-09-08 11:56:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #ClearFake #CyberSecurity #GitHub #HTTP #HTTPS #InfoSec #NetSupport #NetSupportManager #OTX #OpenThreatExchange #RCE #Talos #bot #CyberHunter_NL

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Indicators extracted from public reporting. Source: https://raw.githubusercontent.com/Cisco-Talos/IOCs/refs/heads/main/2026/09/clearfake-webdav-infection-chain.txt

Pulse ID: 6a9ff7e7bd8d139e1855cdf6
Pulse Link: https://otx.alienvault.com/pulse/6a9ff7e7bd8d139e1855cdf6
Pulse Author: CyberHunter_NL
Created: 2026-09-08 11:56:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #ClearFake #CyberSecurity #GitHub #HTTP #HTTPS #InfoSec #NetSupport #NetSupportManager #OTX #OpenThreatExchange #RCE #Talos #bot #CyberHunter_NL

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Indicators extracted from public reporting. Source: https://raw.githubusercontent.com/Cisco-Talos/IOCs/refs/heads/main/2026/09/clearfake-webdav-infection-chain.txt

Pulse ID: 6a9ff7e7bd8d139e1855cdf6
Pulse Link: https://otx.alienvault.com/pulse/6a9ff7e7bd8d139e1855cdf6
Pulse Author: CyberHunter_NL
Created: 2026-09-08 11:56:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #ClearFake #CyberSecurity #GitHub #HTTP #HTTPS #InfoSec #NetSupport #NetSupportManager #OTX #OpenThreatExchange #RCE #Talos #bot #CyberHunter_NL

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Indicators extracted from public reporting. Source: https://raw.githubusercontent.com/Cisco-Talos/IOCs/refs/heads/main/2026/09/clearfake-webdav-infection-chain.txt

Pulse ID: 6a9ff7e7bd8d139e1855cdf6
Pulse Link: https://otx.alienvault.com/pulse/6a9ff7e7bd8d139e1855cdf6
Pulse Author: CyberHunter_NL
Created: 2026-09-08 11:56:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #ClearFake #CyberSecurity #GitHub #HTTP #HTTPS #InfoSec #NetSupport #NetSupportManager #OTX #OpenThreatExchange #RCE #Talos #bot #CyberHunter_NL

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Indicators extracted from public reporting. Source: https://raw.githubusercontent.com/Cisco-Talos/IOCs/refs/heads/main/2026/09/clearfake-webdav-infection-chain.txt

Pulse ID: 6a9ff7e7bd8d139e1855cdf6
Pulse Link: https://otx.alienvault.com/pulse/6a9ff7e7bd8d139e1855cdf6
Pulse Author: CyberHunter_NL
Created: 2026-09-08 11:56:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cisco #ClearFake #CyberSecurity #GitHub #HTTP #HTTPS #InfoSec #NetSupport #NetSupportManager #OTX #OpenThreatExchange #RCE #Talos #bot #CyberHunter_NL