ClearFake Chain Abuses WebDAV and Cloudflare Workers to Deliver Amatera, ZigCryptoStealers
A sophisticated ClearFake infection chain leverages WebDAV and Cloudflare Workers to distribute Amatera stealer, ZigCryptoStealer, and NetSupport Manager, targeting users with fake CAPTCHA prompts.
Cisco Talos has detailed a complex ClearFake infection chain that utilizes WebDAV for initial execution and Cloudflare Workers to serve malicious JavaScript, ultimately delivering a suite of information-stealing malware. The investigation began after observing a DLL file named "verification.google" executing from a WebDAV share within a Ukrainian government organization. While the attacks do not appear to be highly targeted, they are part of a broader operation focused on stealing cryptocurrency and credentials, with the Amatera stealer serving as the primary payload.
The attack chain begins with a compromised website where a malicious Cloudflare Worker injects JavaScript code. This JavaScript then queries a contract on the BNB Smart Chain testnet, using the blockchain as a form of remotely changeable storage for encoded malicious scripts, a technique known as EtherHiding. The retrieved JavaScript is designed to detect local and headless browser environments and then fetch the next stage of the payload from a second blockchain contract, depending on the victim's operating system.
For Windows victims, the chain proceeds to download a side-loading package. This package involves a signed Chrome component that loads a malicious NativeAOT DLL, "secur32.dll." This DLL then deploys the Amatera stealer. In one observed variant, the Amatera stealer was further instructed by its command-and-control (C2) infrastructure to download and execute ZigCryptoStealer, along with a Go-based reverse TCP proxy. This variant also employed a vulnerable driver to disable endpoint detection and response (EDR) software.
A separate branch of the infection chain, linked to the "verification.google" DLL, delivered NetSupport Manager as a secondary payload. This installation included configuration pointing to a Russian-based C2 server, leading Talos to assess with moderate confidence that this specific activity was conducted by a Russian threat actor, tracked as UAT-10820.
The "pf.ch" loader, another sample recovered during the investigation, initiated a similar chain. It was also delivered via Cloudflare Workers and BNB Smart Chain, but its secondary payload included ZigCryptoStealer and a Go reverse proxy. The Amatera configuration in this instance also directed the download of a separate x86 shellcode loader.
This campaign highlights the evolving tactics of threat actors using legitimate-looking infrastructure and services, such as Cloudflare Workers and blockchain technology, to host and distribute malware. The use of WebDAV for initial execution, combined with sophisticated JavaScript injection and multi-stage payloads, presents a significant challenge for detection and defense.
Talos notes that this campaign is part of a wider trend of Amatera distribution through various infection chains. Previous reports have documented its delivery via RenPy Loader, MSBuild, EtherHiding, and even concealed within PNG images, underscoring the adaptability of the malware and its operators. The current findings, however, do not indicate shared infrastructure or direct links to those previously documented activities, suggesting distinct but related operations.
The investigation underscores the importance of monitoring for unusual execution patterns, such as DLLs being launched from WebDAV shares, and the creative ways threat actors abuse cloud services and blockchain technology to evade security measures and deliver their malicious payloads.