TF-1932678 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ClearFake. Confidence: 100. First seen: 2026-09-25 06:27:27 UTC. Reporter: penislandrocket. Tags: ClearFake, ClickFix, etherhiding.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ClearFake. Confidence: 100. First seen: 2026-09-25 06:27:27 UTC. Reporter: penislandrocket. Tags: ClearFake, ClickFix, etherhiding.

• ClearFake Uses BSC Testnet Smart Contracts for Takedown-Resistant ...
  web:cybersecuritynews.com

  A new and dangerously clever malware campaign called ClearFake has been caught using blockchain smart contracts to run its operations, making it nearly impossible for security teams to shut it down. Instead of relying on traditional servers that can be taken offline, the attackers hid their command-and-control infrastructure inside the BNB Smart Chain testnet, a decentralized network that no ...

  2026-09-25 15:08 UTC
• | Expel ClearFake malware: New living off the land techniques
  web:expel.com

  SyncAppvPublishingServer.vbs is a legitimate system file located in C:\Windows\System32. The script is intended for synchronizing App-V environments, but it has a command injection flaw enabling it to be used to silently run malicious PowerShell code.

  2026-09-25 15:08 UTC
• ClearFake Abuses BSC Testnet Contracts for Resilient C2 Operations
  web:gbhackers.com

  Threat actors behind the ClearFake campaign have adopted a novel and highly resilient command-and-control (C2) architecture by leveraging BNB Smart Chain (BSC) testnet.

  2026-09-25 15:08 UTC
• ClearFake and CastleLoader Use Paste-and-Run Attacks
  web:socprime.com

  The report examines the widespread use of ClearFake and the emergence of CastleLoader, a malware loader that relies on paste-and-run techniques. CastleLoader delivers multiple payload types, including RATs and infostealers, while abusing legitimate Python distributions through a Bring-Your-Own-Interpreter (BYOI) approach.

  2026-09-25 15:08 UTC
• ClearFake Campaign - Delivering Malware via "Fake Browser Updates
  web:www.bridewell.com

  ClearFake is a relatively new, malicious JavaScript framework that was first identified in July 2023 by security researcher Randy McEoin.

  2026-09-25 15:08 UTC
• ClearFake: From Fake CAPTCHAs to Blockchain-Driven Payload Retrieval
  web:www.darktrace.com

  Darktrace detected a potential ClearFake‑related incident involving signs of EtherHiding activity and interactions with blockchain‑based infrastructure. A single device showed repeated suspicious command‑line behavior, primarily involving Microsoft HTML Application Host. The activity occurred over the course of a day and indicated early‑stage attempts to load malicious content ...

  2026-09-25 15:08 UTC
• ClearFake malware — IOCs & CVEs | isMalicious
  web:www.ismalicious.com

  30,881 indicators of compromise attributed to the ClearFake malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  2026-09-25 15:08 UTC
• The Rapid Evolution of CLEARFAKE Delivery - kroll.com
  web:www.kroll.com

  User awareness remains a key mitigation , ensuring users remain vigilant for fake captcha popups and understanding the threat from copy/pasting commands into the "run" box. Kroll continues to observe widespread attempted initial access through CLEARFAKE via fake CAPTCHA pop-ups across a wide range of industry sectors.

  2026-09-25 15:08 UTC
• Clearfake Walkthrough 06 03 2024 Clearfake | ThreatDown
  web:www.threatdown.com

  ClearFake , tested on June 3, 2024 Distribution (Compromised site->fake error->copy/paste PowerShell) ClearFake is a malware campaign using social engineering first discovered by Randy McEoin. It is one of the many "fake browser updates" inspired by OG SocGholish which leverages compromised websites to target potential victims.

  2026-09-25 15:08 UTC
• Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC ...
  web:www.trendmicro.com

  TrendAI™ Research analyzed an intrusion where threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. The attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain execution tracker that confirmed each victim compromise in real time.

  2026-09-25 15:08 UTC

Only Available for Registered Users. Sign in to view.