ClearFakeMalware
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.From MISP Galaxy
Last reported 24 days ago, by The Hacker News13 reports
ATT&CK techniques
6 of 35 · each with the sentence it comes from- T1684Social Engineering
“"Overall, threat actors continue to turn trusted platforms into convincing entry points for social engineering, whether via ChatGPT's Custom GPT feature or through Google Sites for hosting a ClickFix attack," Huntress said.”
- T1036Masquerading
“Masquerading”
- T1055Process Injection
“Detects browser process injection initiated originating from the execution of malicious DLL hosted on remote WebDAV UNC path to common browser processes.”
- T1204.004Malicious Copy and Paste
“…ites to deliver malware via drive-by download techniques, often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA).”
- T1219Remote Access Tools
“…, multiple malware distribution campaigns have leveraged the ClickFix lure to spread Windows and macOS infostealers, botnets, and remote access tools.”
- T1552.004Private Keys
“T1552.004”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
13 reports, newest first · the exact sentence from each-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures“A likely compromised website that uses EtherHiding to fetch JavaScript that serves a ClearFake reCAPTCHA verification prompt to coerce victims into running a malicious command that opens a WebDAV path and retrieves a DLL.”
-
Exvicy: A Copycat of the ErrTraffic Malware Distribution Framework“It became a leading competition among ClickFix distribution clusters, alongside ClearFake, KongTuke, SmartApeSG, and IClickFix.”
-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager”
-
MacSync: The Evasive macOS Stealer Exploiting ClickFix Lures“…current evidence does not show that all of them belong to the same threat actor or that MacSync infrastructure operates directly under ClearFake.”
-
Intelligence Insights: August 2026“For the fourth month in a row, ClearFake comes in number 1 on our top 10 most prevalent threat list.”
-
Intelligence Insights: July 2026“ClearFake takes the top spot in this month’s top 10 most prevalent threat list, remaining in 1st for the third month in a row.”
-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“Similar to the ClearFake threat, it employs the EtherHiding technique as Dead Drop Resolver (DDR) to conceal its command and control (C2) infrastructure within the blockchain.”
-
Intelligence Insights: June 2026“Coming in at number one on our top 10 most prevalent threat list, for the second month running, is ClearFake.”
-
Meet IClickFix: a widespread framework using the ClickFix tactic“The lure closely copies ClearFake's page, but Sekoia assesses that two different cybercriminals operate the frameworks.”
-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“ClearFake's Variant: Web3 Exploitation for Malware Delivery”
-
ClickFix tactic: Revenge of detection – Detect Fake CAPTCHA“In May 2024, a new social engineering tactic called ClickFix emerged, featuring a ClearFake cluster that the Sekoia Threat Detection & Research (TDR) team closely monitored and analysed in a private report.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“In May 2024, a new social engineering tactic called ClickFix emerged, featuring a ClearFake cluster that the Sekoia Threat Detection & Research (TDR) team closely monitored and analysed in a private report entitled FLINT 2024-027 - New widespread ClearFake variant abuses PowerShe…”
-
Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet“Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet”
Indicators in its reports
named in the reports above- chatgpt-web[.]vipin 2 reports
- flare[.]ioin 1 report
- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 643ef35536ff9273…44b02131b205in 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.