ClearFake Campaign — Campaign Analysis & Threat Activity

Overview

ClearFake is a malware campaign that leverages proxy execution to run PowerShell commands by abusing a trusted Windows feature. By using legitimate Windows components to execute malicious payloads, it aims to bypass defenses and enable stealthy command execution and deployment of malware. The campaign is significant because it demonstrates attackers abusing trusted OS features to perform command execution, increasing resilience against endpoint controls.

Related Threat Clusters

• ClearFake Malware Campaign Uses Proxy Execution for PowerShell Attacks

  The ClearFake malware campaign has evolved to exploit a command injection vulnerability in trusted Windows components, enabling the execution of malicious PowerShell commands. This sophisticated operation has…

  2 articles · Updated January 22, 2026

Recent Intelligence Reports

• New ClearFake Campaign Leveraging Proxy Execution to Run PowerShell Commands via Trusted Window Feature — Cybersecuritynews · January 22, 2026
• ClearFake malware Exploits Proxy Execution to Run Malicious PowerShell Commands via Trusted Windows Feature — Gbhackers · January 22, 2026

Related Entities