Back Gbhackers

ClearFake malware Exploits Proxy Execution to Run Malicious PowerShell Commands via Trusted Windows Feature

Gbhackers •Mayura Kathir • January 22, 2026

A sophisticated evolution of the ClearFake malware campaign has emerged, deploying advanced evasion techniques that abuse legitimate Windows components to bypass endpoint detection systems. The operation, which has compromised hundreds of websites since August 2025, now leverages a command injection vulnerability in a trusted Windows script to silently execute malicious PowerShell code, while hosting its […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClearFake Malware Campaign Uses Proxy Execution for PowerShell Attacks The ClearFake malware campaign has evolved to exploit a command injection vulnerability in trusted Windows components, enabling the execution of malicious PowerShell commands. This sophisticated operation has compromised hundreds of websites since August 2025, utilizing a fake CAPTCHA to deliver malware while evading detection systems. 2 sources 27

Extracted Entities

ClearFake malware Exploits Proxy Execution to Run Malicious PowerShell Commands via Trusted Windows Feature

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)