ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
ClearFake is a scam that tricks users into running malicious code through fake CAPTCHA prompts on hacked websites. It steals crypto wallets and credentials while disabling security software on Windows PCs.
- Report priority
- Medium
How it works
- Attackers hack websites and inject fake CAPTCHA prompts that look like Google's.
- When users click through, the site loads a hidden library via WebDAV, a remote file-sharing method.
- That library then runs a crypto stealer that changes copied wallet addresses to attacker-controlled ones.
- In some cases, it also installs a backdoor to let attackers take full control of the infected PC.
What to do
Check if you've clicked through fake CAPTCHA prompts on suspicious websites recently. Look for unexpected Chrome components or unusual WebDAV activity in your Task Manager or security software logs. If you see unfamiliar processes like 'chrome_.exe' or 'webdav_.dll' running, immediately disconnect from the internet, run a full antivirus scan, and restore from a clean backup.
ClearFake's crypto stealer can change copied wallet addresses, so never reuse passwords or crypto keys from an infected machine. For government or high-risk users, contact Cisco Talos or your IT team for specialized cleanup instructions.
Technical details
A Ukrainian government employee visits a compromised website. They see a fake Google CAPTCHA prompt and click through. The site secretly loads a malicious library that steals their crypto wallet addresses and disables their antivirus.
ClearFake is a multi-stage crypto-stealing campaign that begins with a fake CAPTCHA prompt on compromised websites, tricking users into executing malicious code. The attack chain injects browser-based payloads, retrieves a remote loader via WebDAV, and deploys ZigCryptoStealer, a crypto-stealing malware that hijacks clipboard operations to replace legitimate cryptocurrency wallet addresses with attacker-controlled ones. The loader also abuses a vulnerable signed Windows driver (BYOVD technique) to terminate endpoint detection and response (EDR) processes, disabling security protections.
Cisco Talos first observed this activity in April 2026 at a Ukrainian government organization, though it was part of a broader theft operation rather than a targeted campaign. The driver-based EDR evasion highlights how even signed code can be weaponized to bypass security layers.