Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential

Gbhackers •Mayura Kathir • September 9, 2026

A multi-stage malware operation that combines fake Google CAPTCHA prompts, WebDAV-hosted DLL execution, malicious Cloudflare Workers and BNB Smart Chain smart contracts to deploy the Amatera information stealer. The activity was first identified in April 2026 after a Ukrainian government organization executed a disguised DLL named “verification.google” from a WebDAV path using the 32-bit rundll32.exe […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClearFake WebDAV Infection Chain Targets Ukrainian Government with Amatera Stealer A cybersecurity investigation revealed a multi-stage malware operation targeting a Ukrainian government organization, utilizing a DLL named 'verification.google' executed from a WebDAV path. The attack, attributed to the threat actor UAT-10820, employs a combination of fake Google CAPTCHA prompts, Cloudflare Workers, and BNB Smart Chain to deliver the Amatera information stealer. The infection chain also includes secondary payloads like ZigCryptoStealer and unauthorized NetSupport Manager installations. Cisco Talos initiated the investigation after observing unusual DLL executions in April 2026. The attack is part of a broader campaign involving multiple delivery methods for the Amatera stealer. The use of Russian IP addresses in command-and-control infrastructure suggests a potential state-sponsored link. The operation is ongoing, with researchers urging organizations to enhance their defenses against similar threats. 5 sources 73

Extracted Entities

Hackers Abuse Google CAPTCHA, WebDAV and BNB Smart Chain to Deploy Credential

The full story

Extracted Entities

Attack Types (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (4)

Tools (1)