ClearFake Campaign Uses WebDAV and Fake CAPTCHA Lures to Deploy Amatera Stealer

Multi-Stage Infection Chains Exploit WebDAV Infrastructure

Threat actors are distributing the Amatera information stealer and several secondary payloads through a complex delivery mechanism utilizing WebDAV shares, Cloudflare Workers, and blockchain-based script storage. The campaign was initially identified following suspicious DLL execution over a WebDAV path within a Ukrainian government network.

The infection flow begins when victims visit compromised websites displaying ClickFix prompts designed to imitate Google CAPTCHA verification checks. Unwitting users who follow the site's instructions execute malicious commands that fetch JavaScript code hosted on the BNB Smart Chain using Cloudflare Workers as a proxy layer.

Payload Diversity: From Crypto Theft to Remote Access

The compromised WebDAV delivery architecture uses 32-bit Windows system processes to trigger remote DLL payloads. Analysis revealed multiple loader branches tailored to deploy distinct secondary tools once initial access is established:

• ZigCryptoStealer & Proxying: One loader branch drops a NativeAOT loader that installs ZigCryptoStealer alongside a Go-based reverse proxy to maintain external connectivity.
• NetSupport Manager Deployment: A second loader branch, associated with activity tracked as UAT-10820, installs an unauthorized copy of the NetSupport Manager remote access tool configured to communicate with Russian command-and-control infrastructure.

While an instance of the attack directly affected a Ukrainian government entity, analysts assess with moderate confidence that the broader infrastructure represents a wide-reaching effort aimed at credential and cryptocurrency theft.

By blending social engineering lures like ClickFix with decentralized storage and WebDAV execution paths, the operators effectively conceal payload locations and evade traditional web filtering controls.