The investigation began after Talos identified unusual endpoint activity at a Ukrainian government organisation in April 2026. A remote file disguised as “verification. google” was executed from a WebDAV path through the 32-bit version of Windows rundll32. exe, while the Windows WebClient service was started.
Talos said it assesses with moderate confidence that the activity was not aimed specifically at the Ukrainian organisation but formed part of a broader cryptocurrency and credential-theft campaign. Researchers track the activity linked to the “verification. google” branch as UAT-10820.
Hunting for similar execution patterns led analysts to a second loader called “pf. ch”, allowing them to reconstruct an earlier part of the infection chain. That sequence begins on compromised websites, where a Cloudflare Worker injects code that retrieves further JavaScript stored in a BNB Smart Chain smart contract.
Victims are then shown a counterfeit Google CAPTCHA-style verification page using the ClickFix social-engineering technique. Rather than exploiting a software vulnerability, the lure instructs users to copy or paste a command that ultimately reaches a WebDAV location and launches a disguised DLL through rundll32. exe.
Both observed loaders used 32-bit DLLs whose filenames concealed their true format and invoked their first export by ordinal. Talos said the similarities indicate the two chains are probably related, although researchers did not establish that every stage of the Ukrainian incident was identical to the reconstructed “pf. ch” sequence.
The primary payload in both branches was Amatera, also known in security research as ACR Stealer. The malware is designed to obtain credentials and cryptocurrency-related data and can receive instructions from command-and-control infrastructure to install additional tools.
Talos found that the Amatera configuration associated with “verification. google” contained more than 400 collection entries covering browsers, extensions, messaging applications, cryptocurrency wallets and other software. Its rules included data linked to Telegram, Signal and WhatsApp, more than 100 desktop-wallet locations, password managers, authenticators, FTP and mail clients, VPN software and remote-access tools. Separate file-grabbing rules searched common user directories for private keys, wallet backups, API and OAuth material, two-factor authentication data, password databases and certificate files, underscoring the campaign’s focus on monetisable credentials and digital assets rather than conducting destructive actions against infected computers or corporate networks.
The branches diverged after Amatera execution. The “pf. ch” loader was instructed to deploy a NativeAOT loader running ZigCryptoStealer alongside a reverse proxy written in Go. The “verification. google” branch installed an unauthorised instance of NetSupport Manager, legitimate remote-administration software that can be abused by attackers.
Configuration recovered from that NetSupport installation pointed to a command-and-control server using an IP address based in Russia. Talos said this, together with other evidence, led it to assess with moderate confidence that a Russian threat actor operated the “verification. google” branch. The researchers stopped short of attributing the wider campaign to the same actor.
The findings add to evidence that Amatera is being distributed through several distinct delivery mechanisms. Microsoft has separately documented increased ACR Stealer activity involving ClickFix lures, WebDAV-delivered payloads, staged PowerShell, Python-based loaders and, in some cases, blockchain-backed dead-drop infrastructure for command-and-control resolution.
Security researchers have also previously linked ClearFake campaigns to EtherHiding, a technique in which attackers place malicious or redirecting code in blockchain smart contracts. Because blockchain data is decentralised and difficult for defenders to remove directly, the method can give operators a resilient way to alter or recover parts of an infection chain.
Talos said the browser-side “pf. ch” flow used the blockchain-backed script to deliver the fake verification step, after which the victim’s own actions initiated execution. This makes the campaign heavily dependent on social engineering while allowing malicious code to pass through services and technologies that are normally trusted.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
