New ClearFake Campaign Leveraging Proxy Execution to Run PowerShell Commands via Trusted Window Feature

ClearFake Campaign: A New Phase of Malware Delivery

The ClearFake campaign has advanced, transforming a common fake CAPTCHA scam into a sophisticated malware delivery mechanism. The campaign operates across numerous compromised websites, presenting users with a standard verification challenge. However, this seemingly benign action triggers the execution of concealed code.

The attack initiates when users perform simple keyboard actions, such as pressing Win + R and paste. This method combines social engineering tactics with 'living off the land' techniques, utilizing existing Windows tools instead of deploying obvious malware files.

The infrastructure supporting this operation has been shifted to blockchain smart contracts and a popular content delivery network, effectively evading many domain and IP blocklists that security systems typically use.

Expel analysts and researchers have identified this evolution by tracking ClearFake’s JavaScript framework across compromised sites and examining new loader stages.

The campaign is linked to a traffic distribution system that has potentially delivered malware to approximately 150,000 systems. This estimate is based on unique identifiers stored in a public smart contract on the BNB Smart Chain test network.

Proxy Execution via Trusted Windows Script

ClearFake operators utilize an Ethereum-style smart contract as a command center, updating encoded JavaScript that infected pages retrieve through public Web3 endpoints.

This strategy, coupled with hosting later-stage payloads on jsDelivr, a commonly used CDN, ensures that all external interactions occur on services that are typically not blocked by defenders.

The impact on businesses is significant; users completing what appears to be a harmless CAPTCHA may inadvertently allow attackers code execution capabilities on trusted corporate systems, with minimal traces left on the disk. Subsequent payloads can exfiltrate data, deploy additional malware, or provide remote access, all while masquerading as legitimate network activity.

The core of this new method involves SyncAppvPublishingServer.vbs, a legitimate script located in the Windows System32 directory as part of App-V management. The fake CAPTCHA instructs users to open the Run dialog, where the clipboard contains a crafted command that introduces a malicious argument into this script.

Based on reporting by Cyber Security News.