In addition to online safety, the programme will explore several key areas linked to KCSIE 2026.

Adversaries have ingeniously manipulated Google Docs to perform a function utterly unexpected from a cloud-based word processor: they transformed a standard document into an interactive malware installation vector. Following the conclusion of the prestigious Black Hat and DEF CON security conferences, a malicious actor initiated contact with various attendees via the X platform. Impersonating a senior executive from CoinDesk, the attacker proposed a discussion regarding an upcoming online conference.

Cet article présente une analyse technique approfondie de deux chaînes d'infection parallèles découvertes après l'observation en avril 2026 d'une exécution de DLL via WebDAV dans la télémétrie d'une organisation gouvernementale ukrainienne. Les deux chaînes reposent sur un Cloudflare Worker malveillant injectant du JavaScript dans des sites compromis.

## 1. Basic Information * **Article Title** : ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager * **Publisher** : Cisco Talos * **Publication Date** : 2026-09-08 * **Original Source** : Cisco Talos * **Related Sources** : Dark Reading: ClickFix Campaigns Abuse Legitimate Services * **Related Malware, Groups, CVEs, and Products** : Amatera, ZigCryptoStealer, NetSupport Manager, ClearFake, UAT-10820, BNB Smart Chain, Cloudflare Workers, WebDAV, rundll32.exe, Google Chrome component * **Priority** : High ## 2. Executive Summary Talos analyzed two paths that execute Amatera through WebDAV. It reconstructed the fake-CAPTCHA entry path for pf.ch and assesses that verification.google may share a similar entry path. Their follow-on payloads also differ. ## 3. Attack Flow ### pf.ch: The path Talos reconstructed back to its initial stages 1. A Cloudflare Worker on a compromised website injects ClearFake JavaScript and retrieves OS-specific scripts from BNB Smart Chain. 2. A fake Google CAPTCHA instructs the user to paste and run a command in the Windows Run dialog. 3. `rundll32.exe` loads `pf.ch` from WebDAV and invokes export ordinal 1 to deploy Amatera. 4. This branch subsequently delivers ZigCryptoStealer and a Go reverse proxy, and also attempts to disable EDR using a vulnerable driver. ### verification.google: The path observed on an endpoint 1. At a Ukrainian government organization, Talos observed the WebClient service starting and the 32-bit version of `rundll32.exe` loading `verification.google` from WebDAV. 2. This branch progresses through Amatera to an unauthorized NetSupport Manager installation. 3. Talos assesses with low-to-moderate confidence that its initial delivery path may match pf.ch, but did not directly reconstruct those initial stages. ## 4. Attacker Position and Execution Environment * An attacker able to compromise a website or modify Cloudflare Worker configuration. * An external attacker able to present fake verification instructions to users. ## 5. What Users and Administrators May See ### Users * A Google CAPTCHA-style page tells users to open Windows Run and paste a command. ### Administrators * Inference: Endpoint artifacts may include WebClient startup, rundll32.exe execution referencing WebDAV, and subsequent malware activity. ## 6. Success Conditions and Risk Reduction ### Success Conditions * In the pf.ch branch, the user follows the fake CAPTCHA instructions and pastes and executes the command. Initial user actions in the verification.google branch are unconfirmed. * Communication with WebDAV, BNB Smart Chain, and Cloudflare Workers is permitted. * DLL execution, the in-memory loader, and subsequent payloads evade endpoint controls. ### Failure Conditions and Risk Reduction * Do not treat website instructions to paste into Run or a terminal as legitimate verification; use user education and browser warnings. * Limit WebDAV to business requirements, and block `rundll32.exe` execution from internet UNC paths and invocation by export ordinal. * Correlate unauthorized NetSupport, vulnerable drivers, sideloading through signed binaries, and blockchain RPC access using EDR and proxy data. ## 7. Potential Impact * Theft of browser data, credentials, sensitive files, and cryptocurrency information. * Internal access through a reverse proxy and persistent remote control through NetSupport Manager. * Disabling EDR with a vulnerable driver and executing additional payloads. ## 8. Observable Logs Inference: These are investigation sources and their collection requirements. * **Email** : Where relevant emails exist, preserve the original messages, complete URLs, and delivery records. * **Proxy/SWG/DNS** : Investigate communications with BNB Smart Chain RPC, Cloudflare Workers, WebDAV, and subsequent C2. Inspecting URLs and bodies requires appropriate logging and TLS visibility. * **Endpoint/EDR** : Investigate WebClient service startup, rundll32.exe command lines referencing WebDAV UNC paths, DLL execution, and subsequent processes. Ordinary EDR does not necessarily record Win+R or the paste action itself. * **Identity/IdP** : Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. * **SaaS/Cloud** : For cloud deployments, review audit records for workloads, IAM, and API operations. * **Network** : Review WebDAV, NetSupport, and reverse-proxy destinations. Distinguish the pf.ch and verification.google branches. ## 9. Assessing Attack Success The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations. * **Attempt observed (success unconfirmed)** : Evidence criterion: Confirm contact with a compromised site or fake CAPTCHA. * **User interaction confirmed** : Evidence criterion: Confirm that the user pasted a command into the Windows Run dialog. * **Initial execution confirmed** : Evidence criterion: Confirm execution of the WebDAV DLL through `rundll32.exe`. * **Malware execution or authentication success confirmed** : Evidence criterion: Confirm execution of Amatera, ZigCryptoStealer, NetSupport, or the reverse proxy. * **Data theft or session compromise confirmed** : Evidence criterion: Confirm collection or transmission of credentials, browser data, or files. * **Follow-on compromise confirmed** : Evidence criterion: Confirm EDR shutdown, internal proxy use, or connections to another host. ## 10. Investigation Playbook Inference: Operational recommendations based on publicly described behavior. * **Trigger** : rundll32.exe execution referencing a WebDAV UNC path. * **Initial Checks** : Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure. * **Endpoint** : Investigate WebClient service startup, rundll32.exe command lines referencing WebDAV UNC paths, DLL execution, and subsequent processes. Ordinary EDR does not necessarily record Win+R or the paste action itself. * **Identity and Cloud** : Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations. * **Follow-on Activity** : Review WebDAV, NetSupport, and reverse-proxy destinations. Distinguish the pf.ch and verification.google branches. * **Containment** : Isolate and preserve endpoints where execution occurred, and stop unauthorized RMM or proxy activity. Revoke potentially stolen credentials and sessions. * **Classification** : These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations. ## 11. Defense and Detection Ideas Inference: Operational recommendations based on publicly described behavior. * **Single Event** : rundll32.exe execution referencing a WebDAV UNC path. * **Time-Series Correlation** : Within each branch, correlate WebDAV DLL execution with Amatera and follow-on payloads. Do not require the unconfirmed initial stages of verification.google as a detection prerequisite. * **Threat Hunting** : Investigate communications with BNB Smart Chain RPC, Cloudflare Workers, WebDAV, and subsequent C2. Inspecting URLs and bodies requires appropriate logging and TLS visibility. Review WebDAV, NetSupport, and reverse-proxy destinations. Distinguish the pf.ch and verification.google branches. * **Logging Gaps** : Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise. * **Priority Controls** : Do not treat website instructions to paste into Run or a terminal as legitimate verification; use user education and browser warnings. ## 12. Facts / Inference / Hypothesis ### Facts * Talos began its investigation with telemetry from a Ukrainian government organization showing a DLL named `verification.google` executed from WebDAV through `rundll32.exe`. * In the related `pf.ch` path, a Cloudflare Worker injects JavaScript into a compromised site and retrieves and evaluates OS-specific scripts from a BNB Smart Chain testnet contract. * On Windows, a fake Google CAPTCHA instructs the user to paste into the Run dialog, executing a 32-bit DLL with a disguised extension from a randomized-subdomain WebDAV path using export ordinal #1. * The loader deploys Amatera in memory. The `pf.ch` branch uses a signed Chrome component for DLL sideloading, delivers ZigCryptoStealer and a Go reverse proxy, and attempts to disable EDR with a vulnerable driver. * The verification.google branch installs NetSupport Manager. Talos attributes this branch to Russian threat actors with moderate confidence. Its assessment that both branches share an initial delivery path is made with low-to-moderate confidence. ### Inference * The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility. ### Hypothesis No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation. ## 13. MITRE ATT&CK Mapping * **T1204.004 User Execution: Malicious Copy and Paste (high confidence)** : A fake CAPTCHA prompts the user to paste a command into the Run dialog. * **T1218.011 System Binary Proxy Execution: Rundll32 (high confidence)** : A WebDAV-hosted DLL is executed by export ordinal. * **T1102.003 Web Service: One-Way Communication (high confidence)** : A BNB Smart Chain contract stores payloads. * **T1219 Remote Access Software (high confidence)** : NetSupport Manager provides unauthorized remote access. ## 14. Unknowns and Further Investigation * The complete shared initial path of the two branches. * The number of affected organizations, stolen data, and relationships among operators. * Follow-on payloads in the macOS branch. ## 15. Impact on SOCs and Organizations SOCs should not define ClickFix solely in terms of PowerShell. Trace WebDAV UNC paths, `rundll32` export ordinals, blockchain RPC, Cloudflare Workers, and privileged or unauthorized RMM tools along the same path. Reassess the need for the WebClient service and internet WebDAV on government and enterprise endpoints. ## 16. Audience Summaries * **SOC** : Within each branch, correlate WebDAV DLL execution with Amatera and follow-on payloads. Do not require the unconfirmed initial stages of verification.google as a detection prerequisite. * **Administrators** : Do not treat website instructions to paste into Run or a terminal as legitimate verification; use user education and browser warnings. * **Users** : A Google CAPTCHA-style page tells users to open Windows Run and paste a command.

Cisco Talos linked two WebDAV-based infection chains to the Amatera stealer, including a “verification.google” DLL execution seen at a Ukrainian government organization and a parallel “pf.ch” chain delivered through ClearFake, Cloudflare Workers, and EtherHiding. The campaign used Amatera to steal credentials and cryptocurrency data while delivering secondary payloads such as ZigCryptoStealer,...

We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.

18 malware builds used fake MP4 malware to smuggle NetSupport payloads across 40 servers after ClickFix attacks.

Sometimes, threat actors utilize video files not for mere viewing, but for cunning concealment. Censys specialists recently discovered a sophisticated malware campaign. This campaign actively deploys structurally sound, yet entirely unplayable MP4 files. These files stealthily deliver the NetSupport Manager application. Consequently, following a covert installation, this legitimate remote administration tool grants attackers persistent, unauthorized control over the compromised computer.

Cyber Press, publié le 1er septembre 2026. L'article décrit une campagne active de distribution de NetSupport RAT exploitant des mécanismes de confiance basés sur des plateformes légitimes. Les attaquants utilisent des pages de conversation partagées ChatGPT légitimes (chatgpt.com) comme premier vecteur de confiance.

Article publié le 1er septembre 2026 sur Cyber Press, décrivant une campagne active de distribution de NetSupport RAT exploitant la confiance accordée aux pages partagées de ChatGPT.

脅威アクターが正規のChatGPT会話共有URLを悪用し、被害者をClickFix型の感染フローへと誘導するソーシャルエンジニアリングの罠を仕掛け、最終的にNetSupportリモートアクセスツール(RAT)を配布していることが明らかになりました。 確認されたこの攻撃チェーンは、正規のChatGPT共有リンクchat

サイバー犯罪者が正規のChatGPT会話共有ページを悪用し、複数段階からなるClickFixキャンペーンを通じてNetSupport RATを配布していることが分かりました。 この攻撃は、信頼されたChatGPTのコンテンツ、偽のOpenAIおよびCloudflareのブランディング、クリップボードを利用したPowe

Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works.