{"id":10765,"date":"2025-03-19T13:08:34","date_gmt":"2025-03-19T13:08:34","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/clearfake-infects-9300-sites-with-fake-recaptcha\/"},"modified":"2025-03-19T13:08:36","modified_gmt":"2025-03-19T13:08:36","slug":"clearfake-infects-9300-sites-with-fake-recaptcha","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/clearfake-infects-9300-sites-with-fake-recaptcha\/","title":{"rendered":"ClearFake Infects 9,300 Sites with Fake reCAPTCHA"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 19, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cloud Security \/ Web Security<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

The individuals behind the ClearFake<\/strong> campaign have been observed utilizing fake reCAPTCHA or Cloudflare Turnstile verifications as a means to deceive users into downloading malicious software, including Lumma Stealer and Vidar Stealer.<\/p>\n

ClearFake<\/a>, a threat activity cluster first identified in July 2023, is known for employing fake web browser update baits<\/a> on compromised WordPress sites as a vector for malware distribution.<\/p>\n

This campaign is also recognized for its use of EtherHiding<\/a>, a technique that leverages Binance’s Smart Chain (BSC) contracts to fetch the next-stage payload, making the attack chain more resilient. The ultimate goal of these infection chains is to deliver information-stealing malware capable of targeting both Windows and macOS systems.<\/p>\n

As of May 2024, ClearFake attacks have incorporated a social engineering ploy known as ClickFix<\/a>, which involves deceiving users into running malicious PowerShell code under the guise of addressing a non-existent technical issue.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

According to Sekoia’s analysis<\/a>, “Although this new ClearFake variant continues to rely on the EtherHiding technique and the ClickFix tactic, it has introduced additional interactions with the Binance Smart Chain.”<\/p>\n

“By using smart contract’s Application Binary Interfaces, these interactions involve loading multiple JavaScript codes and additional resources that fingerprint the victim’s system, as well as downloading, decrypting and displaying the ClickFix lure.”<\/p>\n

The latest iteration of the ClearFake framework marks a significant evolution, adopting Web3 capabilities to resist analysis and encrypting the ClickFix-related HTML code.<\/p>\n

The updated multi-stage attack sequence is initiated when a victim visits a compromised site, leading to the retrieval of an intermediate JavaScript code from BSC. The loaded JavaScript is responsible for fingerprinting the system and fetching the encrypted ClickFix code hosted on Cloudflare Pages.<\/p>\n

Should the victim execute the malicious PowerShell command, it leads to the deployment of Emmenhtal Loader<\/a> (aka PEAKLIGHT), which subsequently drops Lumma Stealer.<\/p>\n

\n
\n\"Fake
\n<\/a>\n<\/div>\n

Sekoia observed an alternate ClearFake attack chain in late January 2025 that served a PowerShell loader responsible for installing Vidar Stealer. As of last month, at least 9,300 websites have been infected with ClearFake.<\/p>\n

“The operator has consistently updated the framework code, lures, and distributed payloads on a daily basis,” it added. “ClearFake execution now relies on multiple pieces of data stored in the Binance Smart Chain, including JavaScript code, AES key, URLs hosting lure HTML files, and ClickFix PowerShell commands.”<\/p>\n

“The number of websites compromised by ClearFake suggests that this threat remains widespread and affects many users worldwide. In July 2024, […] approximately 200,000 unique users were potentially exposed to ClearFake lures encouraging them to download malware.”<\/p>\n

The development comes as over 100 auto dealership sites have been discovered compromised with ClickFix lures<\/a> that lead to the deployment of SectopRAT<\/a> malware.<\/p>\n

“Where this infection on the auto dealerships happened was not on the dealership’s own website, but a third-party video service,” said<\/a> security researcher Randy McEoin, who detailed some of the earliest ClearFake campaigns<\/a> in 2023, describing the incident as an instance of a supply chain attack.<\/p>\n

The video service in question is LES Automotive (“idostream[.]com”), which has since removed the malicious JavaScript injection from the site.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

The findings also coincide with the discovery of several phishing campaigns that are engineered to push various malware families and conduct credential harvesting –<\/p>\n