Loading malware…
ClearFake is a financially motivated malware-distribution operation that injects malicious JavaScript into compromised legitimate websites, including WordPress sites. It uses fake browser-update notices and CAPTCHA-style verification overlays to induce visitors to download malware or manually execute attacker-supplied commands. Its ClickFix lures copy malicious commands to the clipboard and instruct victims to paste and execute them through operating-system interfaces. ClearFake includes operating-system-specific delivery stages for Windows and macOS.
ClearFake uses EtherHiding to retrieve encoded JavaScript from smart contracts on BNB Smart Chain. This blockchain-hosted staging allows operators to update malicious content independently of compromised websites and makes distribution infrastructure harder to disrupt. Observed delivery chains also abuse malicious Cloudflare Workers to inject browser code and retrieve subsequent stages.
Windows campaigns have used ClickFix commands to access remote WebDAV resources and execute disguised DLL loaders through ordinal-based execution with the Windows DLL-loading utility. Delivered malware includes Amatera, ZigCryptoStealer, CastleRAT, and unauthorized NetSupport Manager installations. Depending on the payload, resulting compromises can involve credential and cryptocurrency theft, cryptocurrency-address clipboard replacement, persistent remote access, and reverse-proxy deployment. Some downstream chains employ DLL sideloading, process injection, and vulnerable signed drivers to terminate endpoint-security processes; these are payload-chain behaviors rather than universal capabilities of the ClearFake JavaScript.
ClearFake distribution is opportunistic rather than confined to a particular industry. An associated remote-loader branch tracked as UAT-10820 was observed at a Ukrainian government organization in April 2026, within a broader credential- and cryptocurrency-theft operation.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
ClearFake has expanded a fake CAPTCHA scam into a chain that steals cryptocurrency and credentials while disabling endpoint protection.
The technique stack points at the ClickFix and EtherHiding malware-as-a-service ecosystem that grew out of CLEARFAKE and CLEARSHORT...
“VexTrio Viper runs the largest and oldest known TDS with over 165 affiliates including SocGholish and ClearFake.”
29 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: Domains T1583.001 joscramp[.]top + 7 co-hosted domains via Dynadot
MITRE ATT&CK Mapping ... Resource Development Acquire Infrastructure: Server T1583.004 Google Cloud VM with custom DNS/mail infrastructure
Trois acteurs identifiés exploitent cette opportunité en rachetant ces domaines expirés (dropcatch) pour hériter du trafic victime et le rediriger vers leurs propres arnaques ou malwares.
The "pf.ch" loader chain was initiated by ClearFake Javascript injected into the content of a compromised site by a malicious Cloudflare worker.
Lorsque ces domaines expirent, les requêtes continuent d’affluer sans réponse. Trois acteurs identifiés exploitent cette opportunité en rachetant ces domaines expirés (dropcatch) pour hériter du trafic victime...
A malicious Cloudflare Worker injected JavaScript into compromised websites, leading visitors to a fake Google CAPTCHA.
The supplied TTP mapping identifies T1566 — Phishing for UAT-10820.
The campaign leverages multiple delivery and social engineering mechanisms, including fake BSOD screens, reCAPTCHA prompts, and Cloudflare CAPTCHA challenge pages. All these ClickFix lures ultimately lead to OS-specific payload deployment.
CLEARFAKE Mitre ATT&CK TTPs T1059.001 - Command and Scripting Interpreter: PowerShell
The Cloudflare Worker injects JavaScript that queries BNB Smart Chain contracts to retrieve encoded JavaScript.
often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA)
The script overlays a fake Google CAPTCHA-style checkbox onto the compromised page, instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter.
"After the user double clicks the fake update binary, it will proceed to download the next stage payload."
The fake Google CAPTCHA (ClickFix) prompts the victim to execute a command through the Windows Run dialog.
JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted.
CLEARFAKE Mitre ATT&CK TTPs T1027.010 - Obfuscated Files or Information: Command Obfuscation
JADESNOW utilizes EtherHiding to fetch, decrypt, and execute malicious payloads from smart contracts on the BNB Smart Chain and Ethereum. The input data stored in the smart contract may be Base64-encoded and XOR-encrypted.
"ChromeSetup.exe downloads and executes the Microsoft Software Installer (MSI) package..." and "switches intended to avoid detection: /qn /quiet /norestart"
This stage performs several environment checks, such as inspecting for headless browser frameworks and evaluating the system’s user-agent string. If automated browsing behavior is detected, the execution chain terminates.
The initial Javascript code contains routines to check for local and headless browser environments... The next PowerShell stage dynamically resolves native functions and runs an environment check before installing the payload.
"the malware delays execution by using NtDelayExecution, a technique that is usually used to escape sandboxes."
Fingerprint the victim using the User-Agent: The operating system; The web browser.
This stage performs several environment checks, such as inspecting for headless browser frameworks and evaluating the system’s user-agent string. If automated browsing behavior is detected, the execution chain terminates.
The initial Javascript code contains routines to check for local and headless browser environments... The next PowerShell stage dynamically resolves native functions and runs an environment check before installing the payload.
"the malware delays execution by using NtDelayExecution, a technique that is usually used to escape sandboxes."
deceiving users into copying and executing a given malicious PowerShell code... The command is copied into the user’s clipboard data.
MITRE ATT&CK™ Matrix - Windows ... Command and Control Standard Application Layer Protocol
Amatera resolves its C2 through an encoded IP address hosted in a Telegraph page; EtherHiding retrieves content from BNB Smart Chain contracts.
“The technique, named Blockchain Dead Drops (BDD), stores payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand.” The article explicitly maps it to “T1102.001 (Web Service: Dead Drop Resolver).”
« Blockchain Dead Drops (BDD) ... stocker des instructions de malware ou des configurations C2 sur des blockchains publiques » ; « Smart contracts sur Polygon utilisés comme résolveurs C2 ».
“In payload-delivery setups, attackers store malicious code or encrypted payload components on-chain for victim machines to retrieve and execute locally.”
ErrTraffic initially calls the getUrlFromContract() function to retrieve the command-and-control (C2) panel domain from a blockchain smart contract. Instead of hardcoding the server address directly in the script, the malware queries multiple Polygon RPC endpoints
323 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.