ClearFake, an operation infamous for fake CAPTCHA scams, has upgraded its tactics. Recent attacks now deploy a crypto stealer and credential thief that disables endpoint detection and response (EDR) tools by abusing a signed but vulnerable Windows driver.
How ClearFake’s Attack Chain Works
The scheme begins when attackers compromise websites and inject JavaScript via malicious Cloudflare Workers. Visitors are served with a CAPTCHA-like prompt styled as “ClickFix,” claiming to be a standard Google verification. Windows users are tricked into opening the Run dialog, pasting clipboard content, and hitting Enter. That command loads code from a remote WebDAV server using rundll32, executing a numbered library export that kicks off the malicious payload.
The payload itself makes clever use of legitimate and signed software components. A Chrome-signed helper executable is side-loaded alongside a malicious native library—a technique known as DLL side-loading. This is followed by the deployment of ZigCryptoStealer and a signed but flawed driver capable of killing EDR processes once those processes are identified.
The Damage and Why It’s Serious
With endpoint defenses neutralized, the malware focuses on crypto theft. It monitors the clipboard for cryptocurrency addresses and swaps victims’ wallet addresses with attacker-controlled ones—redirecting payments stealthily. An additional feature, dubbed “EtherHiding,” retrieves command-and-control (C2) server details via blockchain contracts, allowing operators to change infrastructure without touching the deployed malware.
Besides the crypto stealer branch, ClearFake also operates a remote-access pathway. That branch installs a backdoor: a hidden remote client that establishes persistence via scheduled tasks, launches at logon, and grants the attacker full desktop access, enabling data theft, commands execution, or further malware deployment.
Warning Signs & Protection Measures
Some red flags to watch: CAPTCHAs that demand using Run, Command Prompt, or PowerShell filled commands; unexpected WebDAV traffic; rundll32 executions by numeric export; sudden driver service installs; or new scheduled tasks with no known origin.
Defensive steps include using driver blocklists, enabling vulnerable-driver protections, and educating users to ignore any site’s demands to run system tools for CAPTCHA checks.
Indicators of compromise revealed in the analysis cover domains, RPC endpoints, BNB Smart Chain contract addresses, driver file names, SHA-256 hashes of malicious archives, and remote-access gateways. These technical markers can help incident responders confirm infections quickly.
This operation was uncovered by Cisco Talos in April 2026 after anomalies were found at a Ukrainian government entity. Investigators say the malware activity is part of a larger global scheme, not limited to that location.
ClearFake’s evolution highlights how scams are becoming more potent, blending social engineering with deep system attacks and blockchain layering. Organizations must accelerate both technical defenses and user awareness—ignoring the latter makes even the strongest tech nearly useless.
