The ClearFake operation has added a dangerous endpoint-defense bypass to its familiar fake CAPTCHA attacks. Visitors to compromised websites are tricked into running a Windows command that ultimately installs cryptocurrency theft malware, steals credentials or gives an operator remote control. One branch also deploys a signed but vulnerable driver to terminate endpoint detection and response processes.

Cisco Talos identified the activity after investigating unusual remote-library execution at a Ukrainian government organization in April 2026. Researchers assess that the incident was one part of a wider financially motivated operation rather than a campaign focused specifically on that organization. Talos tracks the remote-loader branch as UAT-10820.

A fake verification starts the infection

Attackers first compromise a legitimate site and inject browser code through a malicious Cloudflare Worker. The script evaluates the visitor’s environment and retrieves additional instructions from a BNB Smart Chain contract. It then covers the webpage with a Google-style CAPTCHA prompt designed to look like a routine verification step.

Windows users are told to open the Run dialog, paste clipboard content and press Enter. Instead of completing a CAPTCHA, the action invokes a command that reaches a remote WebDAV location. The legitimate Windows utility rundll32 then executes a numbered export from a remotely delivered library. Because the user initiates the command, the attacker does not need to exploit the browser itself.

This ClickFix technique depends on credibility and habit: users expect occasional verification challenges and may follow step-by-step instructions without inspecting the pasted content. A genuine CAPTCHA, however, never needs someone to open Run, PowerShell, Terminal or Command Prompt.

Vulnerable driver turns off security tools

In the cryptocurrency branch, an initial payload downloads an archive containing a legitimate, signed Chrome component alongside a malicious library. When the trusted executable starts, Windows loads the attacker-controlled library placed next to it—a technique known as DLL side-loading.

The malicious loader launches ZigCryptoStealer and installs DCRCVDrv.sys, a signed driver containing exploitable functionality. It searches for security products, identifies their processes and asks the kernel-level driver to terminate them. This bring-your-own-vulnerable-driver technique, often abbreviated BYOVD, abuses the authority of legitimate signed code to interfere with protections that an ordinary process could not stop.

Once monitoring is weakened, ZigCryptoStealer watches the clipboard for cryptocurrency wallet addresses. When a victim copies a destination address, the malware can substitute an address controlled by the attacker. A payment may then be irreversibly redirected even though the user believes the original value was pasted.

Blockchain infrastructure and remote access

The stealer obtains changing command-and-control configuration from a blockchain contract, a method known as EtherHiding. Operators can update infrastructure without changing the malware or relying on their primary delivery server. Decentralized storage also complicates takedowns because defenders cannot simply remove one malicious webpage.

A separate WebDAV branch runs PowerShell to install an unauthorized remote-access client. The installer suppresses the user interface, connects to an attacker-controlled gateway and establishes persistence with a scheduled task at logon. That turns an automated theft event into an interactive intrusion in which an operator can explore the desktop, transfer files, execute commands or deliver additional malware.

Detection and prevention

Organizations should combine awareness training with technical controls. Blocking dangerous drivers and monitoring process relationships can stop later stages even when a user follows the prompt.

• Alert when browsers lead to rundll32 execution or access remote WebDAV paths.
• Use Microsoft’s vulnerable-driver blocklist and prevent unauthorized driver installation.
• Investigate unexpected driver services, scheduled tasks and hidden remote-access software.
• Monitor for clipboard tampering and verify cryptocurrency addresses through a separate channel.
• Teach employees to report any website asking them to paste commands into operating-system tools.

ClearFake’s evolution shows how a simple social-engineering lure can support a layered malware ecosystem. The most reliable defense is to stop the chain early, while maintaining controls that prevent signed-but-vulnerable components from silencing endpoint visibility.