Jun 3, 2026
C2 Hosts: 53
ClearFake
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.
C2 Infrastructure
Hosting/VPS 100%
Last 7 days
Jun 2, 2026
C2 Hosts: 73
Jun 1, 2026
C2 Hosts: 60
May 31, 2026
C2 Hosts: 97
May 30, 2026
C2 Hosts: 101
May 29, 2026
C2 Hosts: 110
May 28, 2026
C2 Hosts: 135
| Date | C2 Hosts |
|---|---|
| Jun 3, 2026 | 53 |
| Jun 2, 2026 | 73 |
| Jun 1, 2026 | 60 |
| May 31, 2026 | 97 |
| May 30, 2026 | 101 |
| May 29, 2026 | 110 |
| May 28, 2026 | 135 |
Further Reading
CoinLurker: The Stealer Powering the Next Generation of Fake Updates opens in a new tab
Learn about the evolution of fake update campaigns like CoinLurker, the techniques it uses and strategies to defend against this next-generation threat.
blog.morphisec.com
ClearFake: a newcomer to the "fake updates" threats landscape opens in a new tab
ClearFake is a new malicious JavaScript framework used on compromised websites to deliver malware with drive-by download technique.
blog.sekoia.io
Redirecting… opens in a new tab
rmceoin.github.io
CLEARFAKE Utilizes Drive-by Compromise to Deliver Information Stealers | Cyber Risk | Kroll opens in a new tab
CLEARFAKE is the term used to describe the malicious in-browser JavaScript framework deployed on compromised webpages as part of drive-by compromise campaigns to deliver information stealers. It ha...
kroll.com