Malware family

ClearFake

Family profile

ClearFake is a cybercriminal web-inject activity cluster first identified in 2023 that compromises legitimate websites and injects malicious HTML and JavaScript to deliver malware through fake browser update, fake CAPTCHA, and related social-engineering lures. It is widely associated with drive-by delivery chains in which visitors to compromised sites are profiled and then presented with deceptive prompts that persuade them to execute attacker-supplied commands themselves, most notably through the ClickFix or paste-and-run technique. ClearFake has also been linked to EtherHiding, using blockchain-hosted content to conceal or stage malicious scripts.

ClearFake primarily operates by abusing compromised web infrastructure rather than exploiting endpoint vulnerabilities. Its infection chains commonly rely on JavaScript-based web injects, clipboard manipulation, fake certificate or browser-fix prompts, and command execution via Windows utilities such as PowerShell, mshta, and msbuild. Reported tradecraft includes multi-stage in-memory loaders, sandbox-evasion checks, AMSI and ETW bypass attempts, use of traffic distribution systems for filtering and redirection, and delivery of additional payloads through staged scripts and archives. ClearFake has been described as an early adopter and prominent user of ClickFix-style user-execution tradecraft.

Payloads delivered through ClearFake infrastructure have included Lumma Stealer, Amatera Stealer, ACR Stealer, NetSupport RAT, Rhadamanthys, Vidar, and other commodity malware. Reporting has also linked ClearFake delivery chains to loaders such as DOILoader/HijackLoader and to follow-on malware including Amadey and cryptocurrency-mining components in some campaigns. By 2025 and 2026, ClearFake was assessed as one of the more prevalent fake-update and web-inject clusters in enterprise telemetry.

ClearFake is tracked by some researchers as UNC5142 in connection with EtherHiding-related activity. It is generally treated as a financially motivated threat cluster rather than a nation-state actor. No single definitive operator attribution is broadly established, and it is typically discussed as an activity cluster rather than a formally identified group with confirmed membership or command structure.

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Jul 21

Observed infrastructure

Last seven days

First activity: Jul 21, 2026
Last activity: Jul 21, 2026
Feed role: C2
Host form: 1 IP / 0 hostnames

Leading locations

Leading providers

ALEXHOST SRL1

Infrastructure traits

Hosting 1

MITRE ATT&CK

ClearFake in ATT&CK

46 distinct techniques

Techniques

46 techniques

T1584.006 Web Services T1189 Drive-by Compromise T1059.001 PowerShell T1204 User Execution T1036 Masquerading T1129 Shared Modules T1056 Input Capture T1555 Credentials from Password Stores T1574.001 DLL T1185 Browser Session Hijacking T1115 Clipboard Data T1539 Steal Web Session Cookie T1497 Virtualization/Sandbox Evasion T1071 Application Layer Protocol T1105 Ingress Tool Transfer T1497.001 System Checks T1041 Exfiltration Over C2 Channel T1027 Obfuscated Files or Information T1059.005 Visual Basic T1566.002 Spearphishing Link T1140 Deobfuscate/Decode Files or Information T1204.002 Malicious File T1059.007 JavaScript T1218.005 Mshta T1082 System Information Discovery T1027.002 Software Packing T1090.003 Multi-hop Proxy T1583.006 Web Services T1036.005 Match Legitimate Resource Name or Location T1608.001 Upload Malware T1071.001 Web Protocols T1569.002 Service Execution T1543.003 Windows Service T1583.001 Domains T1218.014 MMC T1218 System Binary Proxy Execution T1598.001 Spearphishing Service T1005 Data from Local System T1555.001 Keychain T1059.003 Windows Command Shell T1204.001 Malicious Link T1102 Web Service T1566 Phishing T1216 System Script Proxy Execution T1553.002 Code Signing T1204.004 Malicious Copy and Paste