TF-1932756
high
📛 Threat Title
ClearFake: URL that delivers a malware payload https://testingcf.jsdelivr.net/gh/dsteru3421/559f-2414-494a-8560-23ce5908/089c8e…
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: ClearFake. Confidence: 100. First seen: 2026-09-25 09:33:16 UTC. Reporter: threatcat_ch. Tags: ClearFake.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://testingcf.jsdelivr.net/gh/dsteru3421/559f-2414-494a-8560-23ce5908/089c8e594-4e62-a464-d512b030
UrlVoid 0 / 36
IOC database
- Type
- url
- Value
https://testingcf.jsdelivr.net/gh/dsteru3421/559f-2414-494a-8560-23ce5908/089c8e594-4e62-a464-d512b030- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to ClearFake
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: ClearFake. Confidence: 100. First seen: 2026-09-25 09:33:16 UTC. Reporter: threatcat_ch. Tags: ClearFake.
Remediations (10)
-
web:cybersecuritynews.com
ClearFake malware abused blockchain smart contracts and hacked websites to deliver stealthy, hard-to-stop infections.
-
web:darkwebinformer.com
A domain-based indicator has been identified delivering ClearFake JavaScript malware . The domain is flagged for phishing and payload delivery activity and is associated with malicious script injection campaigns designed to trick users into interacting with fraudulent browser updates or phishing pages.
-
web:expel.com
How does ClearFake abuse CDNs to avoid URL blocklists? Another upgrade to this campaign is the use of cdn.jsdelivr [.]net to host the threat actor's malicious JavaScript. jsDelivr is a legitimate and extremely popular content delivery network (CDN) used for hosting JavaScript libraries.
-
web:securereading.com
Technical Overview Threat intelligence monitoring has identified a malicious payload delivery URL associated with the ClearFake malware family. The infrastructure abuses a trusted content delivery network (CDN) to host and distribute malicious content, increasing the likelihood of successful delivery. The URL was flagged with high confidence (100%) and classified as payload delivery ...
-
web:socprime.com
The report examines the widespread use of ClearFake and the emergence of CastleLoader, a malware loader that relies on paste-and-run techniques. CastleLoader delivers multiple payload types, including RATs and infostealers, while abusing legitimate Python distributions through a Bring-Your-Own-Interpreter (BYOI) approach.
-
web:threatfox.abuse.ch
You are viewing the ThreatFox database entry for url https ://testingcf.jsdelivr.net/gh/dsteru3421/559f- 2414 - 494a - 8560 -23ce5908/089c8e594-4e62-a464-d512b030.
-
web:www.darktrace.com
ClearFake is a campaign observed using a malicious JavaScript framework deployed on compromised websites, impacting sectors such as e‑commerce, travel, and automotive. First identified in mid‑2023, ClearFake is frequently leveraged to socially engineer victims into installing fake web browser updates.
-
web:www.ismalicious.com
30,881 indicators of compromise attributed to the ClearFake malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:www.malwarebytes.com
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader.
-
web:www.sekoia.com
By linking the "fake updates" lure to the watering hole technique, ClearFake operators target a wide range of users and conduct effective, scalable malware distribution campaigns. From our telemetry and customers' feedback, we observed an increasing number of communications to ClearFake infrastructure at the end of September 2023.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.