A ClearFake WebDAV infection chain deployed Amatera malware. See how the ClearFake WebDAV infection chain drops crypto stealers on targets.

#ClearFake #Amatera #Malware #Cybersecurity #WebDAV #1

Cisco Talos linked WebDAV chains to Amatera, ZigCryptoStealer, and NetSupport Manager, including a "verification.google" DLL run at a Ukrainian government org and a ClearFake path via Cloudflare Workers and EtherHiding. #Ukraine #Amatera #ClearFake

ClearFake's EtherHiding chain uses BNB Smart Chain as a C2 dead-drop - malware delivered via WebDAV ClickFix. https://intel.threadlinqs.com/threat/TL-2026-2387 #ThreatIntel #Amatera #ZigCryptoStealer #Netsupport

WordlistLoader turns English words into shellcode - DLL unhooking, ETW bypass, one-click wallet theft. https://intel.threadlinqs.com/threat/TL-2026-2367 #ThreatIntel #Amatera #ACR #ClearFake

EtherHiding's Amatera stealer now hides C2 in a hand-crafted WebRTC channel - no signaling server needed. https://intel.threadlinqs.com/threat/TL-2026-2311 #ThreatIntel #Amatera #ACR #AcridRain