Forest Global Training Partners

Cyber Risks · Cisco Talos

Clear Fake WebDAV infection chain delivers Amatera stealer, Zig Crypto Stealer, and Net Support Manager

Summary: Cisco Talos found a WebDAV DLL execution in April 2026 at a Ukrainian government organization, where a remote file named "verification.google" was launched through 32-bit rundll32.exe, leading to two similar delivery chains, two DLL loaders and two ACR/Amatera stealer payloads. The recovered "pf.ch" chain began with ClearFake JavaScript injected into a compromised site by a malicious Cloudflare Worker, which used EtherHiding on BNB Smart Chain contracts to deliver a loader that sideloads a malicious NativeAOT DLL, "secur32.dll", loads ZigCryptoStealer, and uses a vulnerable driver to terminate EDR software, while the "verification.google" branch installed NetSupport Manager via PowerShell.

What's compelling: The "verification.google" configuration carried over 400 entries across browser, extension, messaging, wallet and other-application collection lists plus four file collection rules, and the chain's use of a vulnerable driver to kill EDR means the endpoint controls you rely on may be switched off before the stealer ever runs.

Read the original at Cisco Talos ↗

Topics
Malware
Related