ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

ClearFake has expanded a fake CAPTCHA scam into a chain that steals cryptocurrency and credentials while disabling endpoint protection. It turns compromised websites into launchpads, relying on visitors to run a command that appears routine.

The operation begins with injected browser code, blockchain-hosted instructions, and a ClickFix prompt styled as a Google CAPTCHA. After a user follows the steps, a remote loader retrieves and runs a disguised library through WebDAV.

Cisco Talos analysts identified the activity after seeing unusual remote library execution at a Ukrainian government organization in April 2026. They assess the observed attacks were part of a broader theft operation, not one campaign aimed at that organization.

The consequences can extend beyond stolen browser data. One branch installs a crypto stealer that changes copied wallet addresses, while another can provide remote control to an operator. This gives attackers a route from one deceptive webpage to persistent access and financial theft.

Cisco Talos said in a report shared with Cyber Security News (CSN) that it tracked the activity linked to the remote-loader branch as UAT-10820.

ClearFake Deploys Crypto Stealer

In the crypto-stealer branch, the first payload receives instructions to fetch an archive. A legitimate, signed Chrome component inside that archive is abused to load a malicious library placed beside it, a technique called DLL side-loading.

That library launches ZigCryptoStealer and a signed but vulnerable Windows driver. The loader searches for EDR products and sends matching process identifiers to the driver, which can force them to stop.

This is a bring-your-own-vulnerable-driver, or BYOVD, attack. A driver works deep inside Windows, so process killing can undermine protections that watch the device. Similar driver attacks against EDR tools show why signed code alone cannot be treated as safe.

With defenses weakened, ZigCryptoStealer monitors the clipboard for cryptocurrency addresses. It can replace a copied address with one controlled by the attacker, potentially redirecting a payment without an obvious warning to the victim.

The malware also uses a blockchain contract to obtain changing command infrastructure. That approach, known as EtherHiding, allows operators to update where the stealer communicates without changing the code delivered to an infected computer.

This lets attackers change campaigns quickly and keep malicious content away from their primary delivery infrastructure. Earlier Amatera stealer web campaigns illustrate how ClearFake operators have repeatedly paired hacked sites with fake verification screens.

From Fake CAPTCHA to Control

The delivery chain starts when attackers compromise a website and inject JavaScript through a malicious Cloudflare Worker. The script checks the visitor environment and retrieves more code from BNB Smart Chain before covering the page with a convincing verification prompt.

The prompt instructs Windows visitors to open the Run dialog, paste clipboard content, and press Enter. That action launches a command that accesses a remote WebDAV path and calls rundll32, a legitimate Windows utility, to execute a library export identified only by a number.

This design shifts the crucial execution step to the victim, avoiding the need for a browser exploit. The approach matches a ClickFix WebDAV delivery technique that uses trusted Windows components to load remote malware while obscuring the command’s purpose.

A separate branch uses the same general WebDAV pattern but eventually runs a PowerShell script that installs an unauthorized remote-access client. It hides the client interface, connects to an attacker gateway, and creates a task that starts at logon.

That remote-access capability raises the stakes. Automated theft can collect passwords, session data, wallet material, and selected files, while a human operator may then browse the desktop, transfer files, run commands, or deploy more malware.

Related fake CAPTCHA malware attacks show the same social-engineering model remains effective across changing loaders.

Organizations should teach staff that legitimate CAPTCHA checks never require opening Run, Terminal, PowerShell, or Command Prompt and pasting a command.

Security teams should investigate unusual WebDAV traffic, ordinal-based rundll32 execution, unexpected driver services, and new scheduled tasks, and should use driver blocklists and vulnerable-driver protections.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools appeared first on Cyber Security News.