Security1 publisher3 min readPublished
Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share
Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.
The Watch · Security desk
What happened
- Cisco Talos opened the case on April 2026 endpoint telemetry from a Ukrainian government organisation showing a DLL named verification.google run from a WebDAV UNC path via 32-bit rundll32.exe.
- Pivoting on the WebDAV pattern recovered a full chain: a Cloudflare Worker injects JavaScript stored on BNB Smart Chain, then a ClickFix prompt impersonating Google CAPTCHA leads to Amatera stealer.
- The two Amatera builds got different orders from their C2s, with the pf.ch loader told to deploy a NativeAOT loader running ZigCryptoStealer plus a Go-based reverse proxy.
- The verification.google build was instructed instead to install an unauthorised instance of NetSupport Manager, giving remote control rather than a further stealer.
- That NetSupport configuration pointed at a Russia-based IP address, and Talos attributes the branch, which it tracks as UAT-10820, to a Russian threat actor with moderate confidence.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Domain and file reputation have almost nothing to grade here, so the enforcement point moves to whether the WebClient service may reach WebDAV hosts off your network and whether users can execute web-supplied commands.
- capability One branch ships a vulnerable driver specifically to terminate EDR, which means the endpoint agent is a target of the payload rather than an assumed observer of it.
- exposure A government endpoint that ends up running NetSupport Manager is reachable for interactive access, so an opportunistic stealer chain becomes a doorway someone else steers.
- precedent With Amatera arriving through delivery chains that share no infrastructure, hunting the plumbing is per-crew work that has to be repeated, while the payload keeps its install base.
Take the chain as an enforcement problem. The JavaScript is not hosted on attacker infrastructure at all: a malicious Cloudflare Worker injects ClearFake code into a compromised site, and the code itself is stored on BNB Smart Chain [5][6]. The loader does not arrive as a browser download either. It is fetched over a WebDAV UNC path and executed by ordinal through the 32-bit rundll32.exe, with the Windows WebClient service starting alongside it [1][7].
Count the recovered steps: compromised site, Worker injection, script read from the chain, fake Google CAPTCHA, the user acting on that prompt, WebDAV fetch with WebClient start, ordinal execution [18]. Only one step depends on the victim, and no step puts the loader in a download folder. Two controls fire without knowing any domain in advance: whether WebClient can reach a WebDAV host outside your network, and whether a user's shell runs commands supplied by a web page.
The second stages show how much of the endpoint the operators expect to hold. On the "pf.ch" branch, the C2 sent a side-loading package in which a signed Chrome component loads a malicious NativeAOT DLL, "secur32.dll", which runs ZigCryptoStealer and uses a vulnerable driver to terminate EDR [10], with an x86 shellcode loader carrying a Go reverse TCP proxy delivered alongside [11]. Detection that starts after secur32.dll loads is racing a driver built to end it.
Talos grades its own reconstruction. The two delivery chains are identical with low to medium confidence [8]; the assessment that the operation is opportunistic crypto and credential theft rather than targeting is moderate [2]; the Russian attribution of the "verification.google" branch rests on a NetSupport Manager configuration pointing at a Russia-based IP, also moderate [13]. The published account does not give the command text the fake CAPTCHA asks the user to run, and the only named victim environment is the single Ukrainian government organisation [1].
Amatera is the constant across chains that share nothing else. Three months after the April telemetry hit [17], Malwarebytes documented fake game and software downloads using RenPy Loader, MSBuild and EtherHiding to deliver the same stealer [14], and Blackpoint Cyber described a fake-verification chain built on a signed Microsoft App-V script, configuration stored in Google Calendar and a payload concealed in a PNG [15]. Talos found no common infrastructure linking those to its two chains [16]. Detections keyed to Cloudflare Workers or blockchain-hosted script cover one crew's plumbing, then. What all three routes share is a user persuaded to execute something and a signed or trusted binary doing the loading [10][14][15]. For the WebDAV variant, the cheapest signal to instrument is the WebClient service start: it is what accompanied the execution that opened the case [1].
What to watch
- Whether Talos publishes the command text the fake CAPTCHA supplies and the WebDAV host set for UAT-10820, which would turn categorical egress blocking into a specific block list.
- Whether the vulnerable driver used to terminate EDR on the pf.ch branch is named and added to driver blocklists.
- Whether any later reporting links the ClearFake WebDAV chains to the RenPy/MSBuild or App-V routes by infrastructure rather than by shared payload.