ClearFake Malware Campaign Uses Proxy Execution for PowerShell Attacks

ClearFake Malware Campaign Uses Proxy Execution for PowerShell Attacks

First seen 22 Jan 2026, 21:42 UTC •GbhackersCybersecuritynews •82% similarity •26.6

Article Content

Browse articles
ThreatCluster

The ClearFake malware campaign has evolved to exploit a command injection vulnerability in trusted Windows components, enabling the execution of malicious PowerShell commands. This sophisticated operation has compromised hundreds of websites since August 2025, utilizing a fake CAPTCHA to deliver malware while evading detection systems.

ThreatCluster AI

Timeline

2025-08-01
ClearFake campaign began exploiting websites.
Recent
New phase of ClearFake malware deployed.

Extracted Entities

1 / 2

Community

Browse all →