other

UAT-10820

A threat activity cluster tracked by Cisco Talos, associated with the "verification.google" fake-CAPTCHA lure and WebDAV-based loader chains.

Known aliases

verification.google actor

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share

Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.

Publishers:blog.talosintelligence.com

Reality

Evidence68
Adoption38
Hype gap−12
Incentives55
Confidence60

product1 publisher

Talos found ClickFix operators moving their skimmer into a Tampermonkey userscript

The lure is a fake leaked vulnerability report promising 38% higher payouts to anyone greedy enough to paste the code. The command channel is a public Google Sheet that Talos reported twice and that stayed up.

Publishers:siliconangle.com

Reality

Evidence64
Adoption68
Hype gap−8
Incentives62
Confidence60