CLEARFAKE WEBDAV INFECTION CHAIN DELIVERS AMATERA STEALER, ZIGCRYPTOSTEALER, AND NETSUPPORT MANAGER

Summary from the TLDR InfoSec newsletter

Cisco Talos identified two WebDAV-based infection chains delivering the Amatera Stealer to facilitate untargeted credential and cryptocurrency theft. The initial chain executed a DLL named "verification.google" at a Ukrainian government organization. A parallel "pf.ch" chain used ClearFake JavaScript stored on the BNB Smart Chain, alongside a fake Google CAPTCHA ClickFix prompt, to task secondary payloads, including ZigCryptoStealer and NetSupport Manager.