Amatera via ClearFake and WebDAV

Summary

Cisco Talos published this analysis on 8 September 2026. It began in April 2026 with a Google-named DLL that a Ukrainian government endpoint ran from a WebDAV share; Talos assesses with moderate confidence that the operation is opportunistic theft of crypto and credentials, not aimed at that organisation. Hunting for the pattern recovered the chain behind a second, similar loader. A rogue Cloudflare Worker injects ClearFake script into a compromised page, the script reads its next stage from BNB Smart Chain contracts, and Windows visitors see a Google-style CAPTCHA asking for a Run-dialog paste. The paste opens the disguised DLL over WebDAV through rundll32, which unpacks Amatera Stealer. Its controllers then tasked more payloads: ZigCryptoStealer with an EDR-killing driver and a Go reverse proxy on one branch, and a silent NetSupport Manager install on the other, whose actor Talos tracks as UAT-10820.

Cross-vendor timeline

2 published accounts. Cisco Talos was first, on 2026-09-08. The most recent is rmceoin, 1 day later.

1. 2026-09-08Cisco Talos

   ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

2. 2026-09-09rmceoin+1 day

   ClearFake 2026

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Overlap with other campaigns

We compared the 22 indicators in this record — covering 14 distinct registrable domains — against the 60 other published campaigns in this corpus.

• PasteSwitch ClickFix operation

  2026-10-11

  7 of the 22 indicators in Amatera via ClearFake and WebDAV also appear in this campaign.

  Shared registrable domains (5)

  • gstats-api-contact[.]ccdomain, shown defanged for safety: gstats-api-contact dot cc
  • propertyfind[.]ccdomain, shown defanged for safety: propertyfind dot cc
  • quorashift[.]ccdomain, shown defanged for safety: quorashift dot cc
  • vexlatech[.]ccdomain, shown defanged for safety: vexlatech dot cc
  • vogueatelier[.]ccdomain, shown defanged for safety: vogueatelier dot cc

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

22 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.