ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

What it is

Cisco Talos tracks two WebDAV infection chains under actor UAT-10820, both starting from ordinal-#1 rundll32.exe execution of disguised 32-bit DLLs: pf.ch and verification.google. The latter was found at a Ukrainian government organization in April 2026.

How it works

The pf.ch branch originates from ClearFake JavaScript injected via a Cloudflare Worker, which queries a BNB Smart Chain testnet contract (0x886d310Ac23e05EA705e24E513D19f53793832A9) for EtherHiding-staged code. The browser-stage script fingerprints the OS and headless state, then for Windows victims overlays a fake Google CAPTCHA that instructs the victim to paste a clipboard command into the Run dialog, opening a WebDAV path on a randomized subdomain of leaguejazire[.]com and executing pf.ch via ordinal #1. pf.ch uses vectored exception handling and Windows fibers to decode an embedded Amatera payload (build 4.1.5-alpha, string GETWELLV2). This Amatera instance resolves its C2 IP via a Telegraph dead-drop page (telegra.ph/Functions-04-03, Base64-decoding to 145.249.109.147), then pulls a JSON config (Base64 + XOR key 852149723\x00) that tasks two secondary loaders: a NativeAOT loader (Secur32.dll sideloaded into a legitimate Chrome component, platform_experience_helper.exe) that drops ZigCryptoStealer plus a signed BYOVD driver (DCRCVDrv.sys, IOCTL 0x2205c0, no caller-authorization check, calls ZwTerminateProcess) to kill EDR processes; and a Go-based Yamux reverse proxy (github.com/acr/proxy-panel/cmd/bot) connecting over wss://update[.]dubbedmuch[.]cc/.

The verification.google branch instead uses DLL hollowing — mapping legitimate dbghelp.dll and overwriting its code section with the unpacked Amatera payload via an async TpAllocWork callback. This Amatera build connects directly to a hardcoded C2 (45.150.34.2:443, domain-fronted as github.com), and its config (400+ collection entries) tasks a PowerShell secondary payload from kr.cedar2glanz[.]ru/jewel.js that installs a trojanized NetSupport Manager 12.44 (license "KAKAN", serial NSM789508 — also seen in EVALUSION/IClickFix activity) pointed at gateway paternal-angrily[.]com:443, resolving to a Russian IP (212.118.56.166).

flowchart TD
  A[ClickFix fake CAPTCHA / EtherHiding on BNB chain] --> B[WebDAV DLL via rundll32 ordinal #1]
  B --> C[pf.ch loader]
  B --> D[verification.google loader]
  C --> E[Amatera: Telegraph dead-drop C2]
  D --> F[Amatera: hardcoded C2, github.com SNI]
  E --> G[ZigCryptoStealer + BYOVD EDR killer]
  E --> H[Go Yamux reverse proxy]
  F --> I[PowerShell installs NetSupport Manager RAT]

Preconditions / Affected

Victim must manually execute the ClickFix clipboard-paste command (social engineering, no exploit). The PowerShell NetSupport installer includes anti-sandbox gates: skips remaining checks if volume serial matches 4E014A2F; requires uptime >10 min; a 500ms NtDelayExecution timing check expecting ≥400ms elapsed; <3 CPUs unexpectedly passes the check; requires ≥3.2GiB RAM; requires GPU with ≥384MiB AdapterRAM; rejects 36 known virtual/remote-display adapter strings.

What to do

ClamAV signatures: Win.Backdoor.BadDav-10060502-0, Win.Backdoor.GoProxShell-10060503-0, Win.Malware.AmateraStomper-10060507-0, Win.Backdoor.BadNetSup-10060508-0, Js.Downloader.ClickFix-10060510-0. Full IOC list published in Talos's GitHub repository.

Caveats

Talos assesses with "low to medium confidence" that the two chains are identical, and only "moderate confidence" that the verification.google branch is Russian-operated (based solely on the NetSupport C2 IP geolocation). The pf.ch Amatera sample was only recovered in memory, never on disk. The macOS side of the pf.ch branch was not pursued by Talos.