1. Basic Information Article Title: ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager Publisher: Cisco Talos Publication Date: 2026-09-08 Original Source: Cisco Talos Related Sources: Dark Reading: ClickFix Campaigns Abuse Legitimate Services Related Malware, Groups, CVEs, and Products: Amatera, ZigCryptoStealer, NetSupport Manager, ClearFake, UAT-10820, BNB Smart Chain, Cloudflare Workers, WebDAV, rundll32.exe, Google Chrome component Priority: High 2. Executive Summary Talos analyzed two paths that execute Amatera through WebDAV. It reconstructed the fake-CAPTCHA entry path for pf.ch and assesses that verification.google may share a similar entry path. Their follow-on payloads also differ. 3. Attack Flow pf.ch: The path Talos reconstructed back to its initial stages A Cloudflare Worker on a compromised website injects ClearFake JavaScript and retrieves OS-specific scripts from BNB Smart Chain. A fake Google CAPTCHA instructs the user to paste and run a command in the Windows Run dialog. rundll32.exe loads pf.ch from WebDAV and invokes export ordinal 1 to deploy Amatera. This branch subsequently delivers ZigCryptoStealer and a Go reverse proxy, and also attempts to disable EDR using a vulnerable driver. verification.google: The path observed on an endpoint At a Ukrainian government organization, Talos observed the WebClient service starting and the 32-bit version of rundll32.exe loading verification.google from WebDAV. This branch progresses through Amatera to an unauthorized NetSupport Manager installation. Talos assesses with low-to-moderate confidence that its initial delivery path may match pf.ch, but did not directly reconstruct those initial stages. 4. Attacker Position and Execution Environment An attacker able to compromise a website or modify Cloudflare Worker configuration. An external attacker able to present fake verification instructions to users. 5. What Users and Administrators May See Users A Google CAPTCHA-style page tells users to open Windows Run and paste a command. Administrators Inference: Endpoint artifacts may include WebClient startup, rundll32.exe execution referencing WebDAV, and subsequent malware activity. 6. Success Conditions and Risk Reduction Success Conditions In the pf.ch branch, the user follows the fake CAPTCHA instructions and pastes and executes the command. Initial user actions in the verification.google branch are unconfirmed. Communication with WebDAV, BNB Smart Chain, and Cloudflare Workers is permitted. DLL execution, the in-memory loader, and subsequent payloads evade endpoint controls. Failure Conditions and Risk Reduction Do not treat website instructions to paste into Run or a terminal as legitimate verification; use user education and browser warnings. Limit WebDAV to business requirements, and block rundll32.exe execution from internet UNC paths and invocation by export ordinal. Correlate unauthorized NetSupport, vulnerable drivers, sideloading through signed binaries, and blockchain RPC access using EDR and proxy data. 7. Potential Impact Theft of browser data, credentials, sensitive files, and cryptocurrency information. Internal access through a reverse proxy and persistent remote control through NetSupport Manager. Disabling EDR with a vulnerable driver and executing additional payloads. 8. Observable Logs Inference: These are investigation sources and their collection requirements. Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records. Proxy/SWG/DNS: Investigate communications with BNB Smart Chain RPC, Cloudflare Workers, WebDAV, and subsequent C2. Inspecting URLs and bodies requires appropriate logging and TLS visibility. Endpoint/EDR: Investigate WebClient service startup, rundll32.exe command lines referencing WebDAV UNC paths, DLL execution, and subsequent processes. Ordinary EDR does not necessarily record Win+R or the paste action itself. Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. SaaS/Cloud: For cloud deployments, review audit records for workloads, IAM, and API operations. Network: Review WebDAV, NetSupport, and reverse-proxy destinations. Distinguish the pf.ch and verification.google branches. 9. Assessing Attack Success The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations. Attempt observed (success unconfirmed): Evidence criterion: Confirm contact with a compromised site or fake CAPTCHA. User interaction confirmed: Evidence criterion: Confirm that the user pasted a command into the Windows Run dialog. Initial execution confirmed: Evidence criterion: Confirm execution of the WebDAV DLL through rundll32.exe. Malware execution or authentication success confirmed: Evidence criterion: Confirm execution of Amatera, ZigCryptoStealer, NetSupport, or the reverse proxy. Data theft or session compromise confirmed: Evidence criterion: Confirm collection or transmission of credentials, browser data, or files. Follow-on compromise confirmed: Evidence criterion: Confirm EDR shutdown, internal proxy use, or connections to another host. 10. Investigation Playbook Inference: Operational recommendations based on publicly described behavior. Trigger: rundll32.exe execution referencing a WebDAV UNC path. Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure. Endpoint: Investigate WebClient service startup, rundll32.exe command lines referencing WebDAV UNC paths, DLL execution, and subsequent processes. Ordinary EDR does not necessarily record Win+R or the paste action itself. Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations. Follow-on Activity: Review WebDAV, NetSupport, and reverse-proxy destinations. Distinguish the pf.ch and verification.google branches. Containment: Isolate and preserve endpoints where execution occurred, and stop unauthorized RMM or proxy activity. Revoke potentially stolen credentials and sessions. Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations. 11. Defense and Detection Ideas Inference: Operational recommendations based on publicly described behavior. Single Event: rundll32.exe execution referencing a WebDAV UNC path. Time-Series Correlation: Within each branch, correlate WebDAV DLL execution with Amatera and follow-on payloads. Do not require the unconfirmed initial stages of verification.google as a detection prerequisite. Threat Hunting: Investigate communications with BNB Smart Chain RPC, Cloudflare Workers, WebDAV, and subsequent C2. Inspecting URLs and bodies requires appropriate logging and TLS visibility. Review WebDAV, NetSupport, and reverse-proxy destinations. Distinguish the pf.ch and verification.google branches. Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise. Priority Controls: Do not treat website instructions to paste into Run or a terminal as legitimate verification; use user education and browser warnings. 12. Facts / Inference / Hypothesis Facts Talos began its investigation with telemetry from a Ukrainian government organization showing a DLL named verification.google executed from WebDAV through rundll32.exe. In the related pf.ch path, a Cloudflare Worker injects JavaScript into a compromised site and retrieves and evaluates OS-specific scripts from a BNB Smart Chain testnet contract. On Windows, a fake Google CAPTCHA instructs the user to paste into the Run dialog, executing a 32-bit DLL with a disguised extension from a randomized-subdomain WebDAV path using export ordinal #1. The loader deploys Amatera in memory. The pf.ch branch uses a signed Chrome component for DLL sideloading, delivers ZigCryptoStealer and a Go reverse proxy, and attempts to disable EDR with a vulnerable driver. The verification.google branch installs NetSupport Manager. Talos attributes this branch to Russian threat actors with moderate confidence. Its assessment that both branches share an initial delivery path is made with low-to-moderate confidence. Inference The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility. Hypothesis No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation. 13. MITRE ATT&CK Mapping T1204.004 User Execution: Malicious Copy and Paste (high confidence): A fake CAPTCHA prompts the user to paste a command into the Run dialog. T1218.011 System Binary Proxy Execution: Rundll32 (high confidence): A WebDAV-hosted DLL is executed by export ordinal. T1102.003 Web Service: One-Way Communication (high confidence): A BNB Smart Chain contract stores payloads. T1219 Remote Access Software (high confidence): NetSupport Manager provides unauthorized remote access. 14. Unknowns and Further Investigation The complete shared initial path of the two branches. The number of affected organizations, stolen data, and relationships among operators. Follow-on payloads in the macOS branch. 15. Impact on SOCs and Organizations SOCs should not define ClickFix solely in terms of PowerShell. Trace WebDAV UNC paths, rundll32 export ordinals, blockchain RPC, Cloudflare Workers, and privileged or unauthorized RMM tools along the same path. Reassess the need for the WebClient service and internet WebDAV on government and enterprise endpoints. 16. Audience Summaries SOC: Within each branch, correlate WebDAV DLL execution with Amatera and follow-on payloads. Do not require the unconfirmed initial stages of verification.google as a detection prerequisite. Administrators: Do not treat website instructions to paste into Run or a terminal as legitimate verification; use user education and browser warnings. Users: A Google CAPTCHA-style page tells users to open Windows Run and paste a command.