In April 2026, Cisco Talos observed an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization: the remote file "verification.google" was launched by 32-bit rundll32.exe. Boarding that pivot revealed two parallel delivery chains using the same ClickFix/WebDAV execution pattern, two distinct DLL loaders, and two Amatera (ACR) stealer payloads. The attacks are assessed with moderate confidence as not targeted at a particular organization, but rather a broad credentials-and-cryptocurrency stealing operation; the "verification.google" branch is attributed with moderate confidence to a Russian threat actor tracked as UAT-10820, based on the NetSupport C2 gateway IP residing in Russia.

The infection chain begins with a compromised legitimate website onto which an unauthorized Cloudflare Worker has been deployed. The Worker injects malicious JavaScript that uses EtherHiding: it makes JSON-RPC eth_call queries to a BNB Smart Chain testnet contract (0x886d310Ac23e05EA705e24E513D19f53793832A9) via the public RPC endpoint bsc-testnet-rpc[.]publicnode[.]com, retrieving next-stage code from immutable blockchain storage. The script checks for headless-browser environments, identifies the OS, and pulls OS-specific stage-2 code from contract 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff (Windows) or 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5 (macOS). It assigns the victim a tracking cookie (cjs_id), queries an on-chain goal tracker, and overlays a convincing fake Google reCAPTCHA checkbox. Clicking it triggers a ClickFix prompt instructing the user to press Win+R, paste the clipboard, and press Enter. The pasted command uses delayed-expansion to reconstruct pushd/rundll32/popd at execution time and loads a WebDAV DLL (e.g., pf.ch or verification.google) from a randomized subdomain of leaguejazire[.]com (Windows) — or a curl variant against riyazinikokar[.]xyz (macOS) — invoking it via rundll32.exe ordinal #1.

The "pf.ch" loader is a packed 32-bit DLL exporting only "moor", using vectored exception handling, XOR loops, API hashing, and obfuscated control flow; a thread waits on a "hit" event, then copies an embedded blob into memory and transfers control via Windows fibers. The final Amatera payload (build label 4.1.5-alpha, string GETWELLV2) is XOR+LZNT1-decoded, walks module export tables to resolve APIs, and executes 32-to-64-bit transitions (direct WoW64 syscall stubs) to bypass EDR user-mode hooks. Amatera communicates over an ECDH + ChaCha20-Poly1305 encrypted protocol, decrypts its configuration via Base64 then XOR (key 852149723) into JSON, and resolves its C2 through a Telegraph dead-drop page (telegra[.]ph/Functions-04-03) to 145.249.109[.]147:443 (pf.ch branch) or a fixed encrypted address 45.150.34[.]2:443 presented with github[.]com as the TLS SNI (verification.google branch). Its configuration lists 400+ collection entries: browser/profile data, Telegram/Signal/WhatsApp, 100+ desktop wallet locations, KeePass/Bitwarden/1Password/RoboForm/NordPass, WinAuth/Authy, FileZilla, AnyDesk, NordVPN/AzireVPN, and file-grabber rules for Desktop/Downloads/Documents/Recent targeting .kdbx, .p12, .pfx, .pem and 100+ other private-key/wallet/2FA patterns. A secondary-payload tasking mechanism (ld array) supports executables, DLLs, PowerShell, raw shellcode, and MSI in file or fileless modes.

Secondary payloads diverge by branch. The "pf.ch" chain delivers a ZIP (279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92) containing the legitimate signed Google Chrome component platform_experience_helper.exe and a malicious Secur32.dll it sinks (DLL side-loading via the GetUserNameExW import). The .NET NativeAOT loader decrypts and loads two PEs: ZigCryptoStealer (written in the Zig language), which spawns C:\Windows\explorer.exe suspended, manually maps its PE into the child, restores the thread context and resumes it (process injection), then polls the clipboard and swaps recognized cryptocurrency addresses for attacker-controlled wallets, exfiltrating the original addresses. It queries BNB Smart Chain via bsc[.]rpc[.]blxrbdn[.]com disguised as an ERC-20 balance check against contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468, whose setData(string) function returns the current C2 domain (39 C2 rotations between March 16 and July 26; recent values include static[.]quorashift[.]cc and lb[.]propertyfind[.]cc, both behind Cloudflare). The second PE is the signed but vulnerable kernel driver DCRCVDrv.sys (MOCOMSYS/DCRC, device \Device\DCRCVDRV_U) whose IOCTL 0x2205c0 terminates an arbitrary process PID with no caller authorization — a BYOVD EDR-killer used to kill security processes enumerated by name hash. The same chain also stages a fileless Go reverse TCP proxy (shellcode 643ef355...; unpacked 1819827e17...) that opens a WebSocket Secure session to update[.]dubbedmuch[.]cc/, reads the MachineGuid and hostname, and multiplexes bidirectional relay streams via HashiCorp Yamux (protocol tunneling).

The "verification.google" loader uses dynamically resolved TpAllocWork callbacks inside a large control-flow-flattening loop, decodes runtime syscall numbers for direct WoW64 stubs, and hollows a clean in-memory dbghelp.dll (module stomping) before pivoting to the Amatera payload. Its NetSupport Manager task is downloaded as PowerShell from kr[.]cedar2glanz[.]ru/jewel[.]js (IEX, fileless). The staging script enforces strict anti-analysis gates (C: volume serial check against 4E014A2F, uptime below 10 minutes aborts, a native NtDelayExecution timing measurement, CPU count, 3.2 GiB RAM floor, 384 MiB VRAM floor, and 36 display-adapter fingerprints), derives an install path from a hash of MachineGuid|zdozwoqx3c, and generates decoy HTTPS traffic from background runspaces to GitHub, npm, Docker Hub, PyPI, NuGet, and the PowerShell Gallery. The final ZIP (bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b) is fetched from phys[.]stunned-amniotic[.]com/hub[.]log and extracted to %APPDATA%; hypersnap.exe (a renamed signed NetSupport Manager 12.44 client32.exe) runs hidden, calls the _NSMClient32@8 export in PCICL32.DLL, and persists via a scheduled task at user logon. NetSupport client32.ini hides the tray and disables visible controls, and the client polls the HTTP gateway paternal-angrily[.]com:443 (212.118.56[.]166, Russia) every 60 seconds. The NetSupport license (KAKAN, serial NSM789508) matches licenses seen in both the EVALUSION and IClickFix campaigns. G DATA and Trend Micro independently documented adjacent EtherHiding/Amatera ClearFake chains (SectopRAT + ACRStealer; HijackLoader + ACRStealer) showing the same contracts, but Talos found no common infrastructure tying those campaigns to this one.