ClearFake WebDAV Infection Chain Targets Ukrainian Government with Amatera Stealer

• •The ClearFake infection chain targets Ukrainian government entities using WebDAV.
• •Amatera stealer is the primary payload, with ZigCryptoStealer and NetSupport Manager as secondary threats.
• •The operation is linked to a Russian threat actor, UAT-10820, and employs deceptive techniques like fake CAPTCHA prompts.

A cybersecurity investigation revealed a multi-stage malware operation targeting a Ukrainian government organization, utilizing a DLL named 'verification.google' executed from a WebDAV path. The attack, attributed to the threat actor UAT-10820, employs a combination of fake Google CAPTCHA prompts, Cloudflare Workers, and BNB Smart Chain to deliver the Amatera information stealer. The infection chain also includes secondary payloads like ZigCryptoStealer and unauthorized NetSupport Manager installations. Cisco Talos initiated the investigation after observing unusual DLL executions in April 2026. The attack is part of a broader campaign involving multiple delivery methods for the Amatera stealer. The use of Russian IP addresses in command-and-control infrastructure suggests a potential state-sponsored link. The operation is ongoing, with researchers urging organizations to enhance their defenses against similar threats.