# ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport Manager 12.44 (UAT-10820)

> Cisco Talos documented a multi-stage ClearFake infection chain first detected via suspicious WebDAV DLL execution ("verification.google" launched by 32-bit rundll32.exe) at a Ukrainian government organization. Compromised websites serve a Cloudflare Worker that pulls malicious JavaScript from BNB Smart Chain testnet contracts (EtherHiding), then uses a ClickFix fake-Google-CAPTCHA prompt to drive WebDAV-based DLL loading. The chain delivers Amatera (ACR) stealer 4.1.5-alpha alongside two divergent secondary payloads: a Zig-language cryptocurrency clipboard hijacker (ZigCryptoStealer) plus a Go reverse TCP proxy (Yamux), or an unauthorized NetSupport Manager 12.44 RAT instance with a BYOVD EDR-killer driver (DCRCVDrv.sys, IOCTL 0x2205c0). The "verification.google" branch is attributed with moderate confidence to Russian threat actor UAT-10820 running a financial credentials-and-cryptocurrency operation.

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2387
- **ID:** TL-2026-2387
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** UAT-10820 (Russia)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In April 2026, Cisco Talos observed an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization: the remote file "verification.google" was launched by 32-bit rundll32.exe. Boarding that pivot revealed two parallel delivery chains using the same ClickFix/WebDAV execution pattern, two distinct DLL loaders, and two Amatera (ACR) stealer payloads. The attacks are assessed with moderate confidence as not targeted at a particular organization, but rather a broad credentials-and-cryptocurrency stealing operation; the "verification.google" branch is attributed with moderate confidence to a Russian threat actor tracked as UAT-10820, based on the NetSupport C2 gateway IP residing in Russia.

The infection chain begins with a compromised legitimate website onto which an unauthorized Cloudflare Worker has been deployed. The Worker injects malicious JavaScript that uses EtherHiding: it makes JSON-RPC eth_call queries to a BNB Smart Chain testnet contract (0x886d310Ac23e05EA705e24E513D19f53793832A9) via the public RPC endpoint bsc-testnet-rpc[.]publicnode[.]com, retrieving next-stage code from immutable blockchain storage. The script checks for headless-browser environments, identifies the OS, and pulls OS-specific stage-2 code from contract 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff (Windows) or 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5 (macOS). It assigns the victim a tracking cookie (cjs_id), queries an on-chain goal tracker, and overlays a convincing fake Google reCAPTCHA checkbox. Clicking it triggers a ClickFix prompt instructing the user to press Win+R, paste the clipboard, and press Enter. The pasted command uses delayed-expansion to reconstruct pushd/rundll32/popd at execution time and loads a WebDAV DLL (e.g., pf.ch or verification.google) from a randomized subdomain of leaguejazire[.]com (Windows) — or a curl variant against riyazinikokar[.]xyz (macOS) — invoking it via rundll32.exe ordinal #1.

The "pf.ch" loader is a packed 32-bit DLL exporting only "moor", using vectored exception handling, XOR loops, API hashing, and obfuscated control flow; a thread waits on a "hit" event, then copies an embedded blob into memory and transfers control via Windows fibers. The final Amatera payload (build label 4.1.5-alpha, string GETWELLV2) is XOR+LZNT1-decoded, walks module export tables to resolve APIs, and executes 32-to-64-bit transitions (direct WoW64 syscall stubs) to bypass EDR user-mode hooks. Amatera communicates over an ECDH + ChaCha20-Poly1305 encrypted protocol, decrypts its configuration via Base64 then XOR (key 852149723) into JSON, and resolves its C2 through a Telegraph dead-drop page (telegra[.]ph/Functions-04-03) to 145.249.109[.]147:443 (pf.ch branch) or a fixed encrypted address 45.150.34[.]2:443 presented with github[.]com as the TLS SNI (verification.google branch). Its configuration lists 400+ collection entries: browser/profile data, Telegram/Signal/WhatsApp, 100+ desktop wallet locations, KeePass/Bitwarden/1Password/RoboForm/NordPass, WinAuth/Authy, FileZilla, AnyDesk, NordVPN/AzireVPN, and file-grabber rules for Desktop/Downloads/Documents/Recent targeting .kdbx, .p12, .pfx, .pem and 100+ other private-key/wallet/2FA patterns. A secondary-payload tasking mechanism (ld array) supports executables, DLLs, PowerShell, raw shellcode, and MSI in file or fileless modes.

Secondary payloads diverge by branch. The "pf.ch" chain delivers a ZIP (279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92) containing the legitimate signed Google Chrome component platform_experience_helper.exe and a malicious Secur32.dll it sinks (DLL side-loading via the GetUserNameExW import). The .NET NativeAOT loader decrypts and loads two PEs: ZigCryptoStealer (written in the Zig language), which spawns C:\Windows\explorer.exe suspended, manually maps its PE into the child, restores the thread context and resumes it (process injection), then polls the clipboard and swaps recognized cryptocurrency addresses for attacker-controlled wallets, exfiltrating the original addresses. It queries BNB Smart Chain via bsc[.]rpc[.]blxrbdn[.]com disguised as an ERC-20 balance check against contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468, whose setData(string) function returns the current C2 domain (39 C2 rotations between March 16 and July 26; recent values include static[.]quorashift[.]cc and lb[.]propertyfind[.]cc, both behind Cloudflare). The second PE is the signed but vulnerable kernel driver DCRCVDrv.sys (MOCOMSYS/DCRC, device \Device\DCRCVDRV_U) whose IOCTL 0x2205c0 terminates an arbitrary process PID with no caller authorization — a BYOVD EDR-killer used to kill security processes enumerated by name hash. The same chain also stages a fileless Go reverse TCP proxy (shellcode 643ef355...; unpacked 1819827e17...) that opens a WebSocket Secure session to update[.]dubbedmuch[.]cc/, reads the MachineGuid and hostname, and multiplexes bidirectional relay streams via HashiCorp Yamux (protocol tunneling).

The "verification.google" loader uses dynamically resolved TpAllocWork callbacks inside a large control-flow-flattening loop, decodes runtime syscall numbers for direct WoW64 stubs, and hollows a clean in-memory dbghelp.dll (module stomping) before pivoting to the Amatera payload. Its NetSupport Manager task is downloaded as PowerShell from kr[.]cedar2glanz[.]ru/jewel[.]js (IEX, fileless). The staging script enforces strict anti-analysis gates (C: volume serial check against 4E014A2F, uptime below 10 minutes aborts, a native NtDelayExecution timing measurement, CPU count, 3.2 GiB RAM floor, 384 MiB VRAM floor, and 36 display-adapter fingerprints), derives an install path from a hash of MachineGuid|zdozwoqx3c, and generates decoy HTTPS traffic from background runspaces to GitHub, npm, Docker Hub, PyPI, NuGet, and the PowerShell Gallery. The final ZIP (bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b) is fetched from phys[.]stunned-amniotic[.]com/hub[.]log and extracted to %APPDATA%; hypersnap.exe (a renamed signed NetSupport Manager 12.44 client32.exe) runs hidden, calls the _NSMClient32@8 export in PCICL32.DLL, and persists via a scheduled task at user logon. NetSupport client32.ini hides the tray and disables visible controls, and the client polls the HTTP gateway paternal-angrily[.]com:443 (212.118.56[.]166, Russia) every 60 seconds. The NetSupport license (KAKAN, serial NSM789508) matches licenses seen in both the EVALUSION and IClickFix campaigns. G DATA and Trend Micro independently documented adjacent EtherHiding/Amatera ClearFake chains (SectopRAT + ACRStealer; HijackLoader + ACRStealer) showing the same contracts, but Talos found no common infrastructure tying those campaigns to this one.

## MITRE ATT&CK

- T1204.001 User Execution: Malicious Link
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1218.011 System Binary Proxy Execution: Rundll32
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1055.001 Dynamic-link Library Injection
- T1685 Disable or Modify Tools
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1036.005 Match Legitimate Resource Name or Location
- T1027.002 Obfuscated Files or Information: Software Packing
- T1555.005 Credentials from Password Stores: Password Managers
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1572 Protocol Tunneling

## Sources

- [ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager (Talos Intelligence)](https://blog.talosintelligence.com/clearfake-webdav-infection-chain/)
- [Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding (Malwarebytes)](https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-games-spread-stealers-with-renpy-loader-msbuild-and-etherhiding)
- [Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet (Trend Micro)](https://www.trendmicro.com/en/research/26/e/smart-contracts-for-command-and-control.html)
- [Novel fake CAPTCHA chain delivering Amatera Stealer (Blackpoint Cyber)](https://blackpointcyber.com/novel-fake-captcha-chain-delivering-amatera-stealer)
- [Beyond the Click: Forensic Analysis of EtherHiding in ClickFix Campaign Infrastructure (Blackpoint Cyber)](https://blackpointcyber.com/beyond-the-click-forensic-analysis-of-etherhiding-in-clickfix-campaign-infrastructure/)
- [EVALUSION ClickFix campaign delivers Amatera Stealer and NetSupport RAT (eSentire)](https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution)
- [Meet IClickFix, a widespread WordPress-targeting framework using the ClickFix tactic (Sekoia)](https://www.sekoia.com/blog/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic)
- [EtherHiding: Hiding Web2 Malicious Code in Web3 Smart Contracts (Guardio Labs)](https://guard.io/labs/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts)
- [The Blockchain Is Not Your Friend: Examining EtherHiding and Using Blockchain for Attacks (CSIDE)](https://cside.com/blog/examining-etherhiding-and-blockchain-for-attacks)
- [Signed, Staged, and Weaponised: Inside an ACRStealer Campaign — DCRCVDrv.sys BYOVD (DarkScene)](https://darkscene.hashnode.dev/signed-staged-and-weaponised-inside-an-acrstealer-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2387