Do Son 
At a glance
Threat researchers from Cisco Talos recently intercepted two sophisticated malware delivery chains. The attackers utilize a ClearFake WebDAV infection chain to drop the Amatera credential stealer. This malware targets cryptocurrency wallets and sensitive credentials across compromised endpoints.
| Category | Details |
|---|---|
| Malware Family | Amatera (ACR Stealer), ZigCryptoStealer, NetSupport Manager |
| Threat Actor | Suspected Russian threat actor (UAT-10820) |
| Targets | Ukrainian government organizations and global cryptocurrency users |
| Delivery Vector | Fake browser updates (ClearFake) and malicious WebDAV execution |
| Key Capabilities | Credential theft, crypto wallet clipping, and remote desktop access |
| Source | Cisco Talos Threat Intelligence |
Executive Summary
The attackers compromised legitimate websites to inject fake Google CAPTCHA prompts. Once the victim follows the instructions, the script launches malicious DLLs directly from a remote WebDAV server. After execution, the Amatera malware steals credentials and deploys persistent remote access tools.
Delivery Mechanism
The attack begins on compromised websites where Cloudflare Workers inject malicious JavaScript. As the Cisco Talos analysis states, “The chain uses a Cloudflare Worker to inject JavaScript code stored on BNB Smart Chain and a ClickFix prompt impersonating Google CAPTCHA.” If a user clicks the fake verification prompt, they inadvertently copy and execute a Windows command. This command triggers the ClearFake WebDAV infection chain without downloading files directly to the local disk.
Infection Chain Architecture
The initial command executes a disguised 32-bit DLL using “rundll32.exe”. The researchers analyzed two distinct loader variants named “verification.google” and “pf.ch”. The “pf.ch” variant unpacks itself using vectored exception handling and control-flow flattening. Conversely, the “verification.google” variant utilizes DLL hollowing to overwrite a clean copy of “dbghelp.dll” with the Amatera payload.
C2 Communication and Data Exfiltration
Once loaded, Amatera retrieves its command-and-control addresses using dead-drop resolvers. For example, the “pf.ch” variant extracts its C2 IP address from an altered Rust programming tutorial hosted on Telegra.ph. The malware then receives secondary payloads. The first branch downloaded a NativeAOT loader that injected ZigCryptoStealer, a tool designed to swap cryptocurrency addresses in the clipboard. Furthermore, this payload deployed a vulnerable Windows driver to terminate local endpoint detection software. The second branch deployed a Go-based reverse TCP proxy to maintain backdoor access. Finally, the “verification.google” branch installed an unauthorized instance of NetSupport Manager.
Defense and Detection Guidance
Security teams must monitor network traffic for unexpected WebClient service execution and outbound WebDAV connections. Administrators should disable WebDAV if it is not strictly required. Furthermore, endpoint detection systems must flag the abuse of “rundll32.exe” calling ordinal #1 functions. Finally, security operations centers should monitor for PowerShell scripts querying system uptime and video adapter RAM, as these indicate advanced environment evasion checks.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
