TLDR Tech / InfoSec
ClearFake WebDAV Infection Chain Delivers Amatera Stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos identified two WebDAV-based infection chains delivering the Amatera Stealer to facilitate untargeted credential and cryptocurrency theft. The initial chain executed a DLL named "verification.google" at a Ukrainian government organization. A parallel "pf.ch" chain used ClearFake JavaScript stored on the BNB Smart Chain, alongside a fake Google CAPTCHA ClickFix prompt, to task secondary payloads, including ZigCryptoStealer and NetSupport Manager.
Read the full story