Hackers Exploit CAPTCHA, Webdav And Blockchain To Steal Credentials Arabian Post

2026-09-10 04:13:34

(MENAFN- The Arabian Post) clearfix">Cybercriminals are combining fake Google CAPTCHA prompts, WebDAV-hosted DLLs, malicious Cloudflare Workers and BNB Smart Chain contracts in a multi-stage operation that deploys the Amatera information stealer and other payloads, according to new research from Cisco Talos.

The investigation began after Talos identified unusual endpoint activity at a Ukrainian government organisation in April 2026. A remote file disguised as“verification. google” was executed from a WebDAV path through the 32-bit version of Windows rundll32. exe, while the Windows WebClient service was started.

Talos said it assesses with moderate confidence that the activity was not aimed specifically at the Ukrainian organisation but formed part of a broader cryptocurrency and credential-theft campaign. Researchers track the activity linked to the“verification. google” branch as UAT-10820.

<p>Hunting for similar execution patterns led analysts to a second loader called“pf. ch”, allowing them to reconstruct an earlier part of the infection chain. That sequence begins on compromised websites, where a Cloudflare Worker injects code that retrieves further JavaScript stored in a BNB Smart Chain smart contract.</p><p>Victims are then shown a counterfeit Google CAPTCHA-style verification page using the ClickFix social-engineering technique. Rather than exploiting a software vulnerability, the lure instructs users to copy or paste a command that ultimately reaches a WebDAV location and launches a disguised DLL through rundll32. exe.</p><p>Both observed loaders used 32-bit DLLs whose filenames concealed their true format and invoked their first export by ordinal. Talos said the similarities indicate the two chains are probably related, although researchers did not establish that every stage of the Ukrainian incident was identical to the reconstructed“pf. ch” sequence.</p>See also  IDScan faces widening class actions over ID exposure <p>The primary payload in both branches was Amatera, also known in security research as ACR Stealer. The malware is designed to obtain credentials and cryptocurrency-related data and can receive instructions from command-and-control infrastructure to install additional tools.</p><p>Talos found that the Amatera configuration associated with“verification. google” contained more than 400 collection entries covering browsers, extensions, messaging applications, cryptocurrency wallets and other software. Its rules included data linked to Telegram, Signal and WhatsApp, more than 100 desktop-wallet locations, password managers, authenticators, FTP and mail clients, VPN software and remote-access tools. Separate file-grabbing rules searched common user directories for private keys, wallet backups, API and OAuth material, two-factor authentication data, password databases and certificate files, underscoring the campaign's focus on monetisable credentials and digital assets rather than conducting destructive actions against infected computers or corporate networks.</p><p>The branches diverged after Amatera execution. The“pf. ch” loader was instructed to deploy a NativeAOT loader running ZigCryptoStealer alongside a reverse proxy written in Go. The“verification. google” branch installed an unauthorised instance of NetSupport Manager, legitimate remote-administration software that can be abused by attackers.</p><p>Configuration recovered from that NetSupport installation pointed to a command-and-control server using an IP address based in Russia. Talos said this, together with other evidence, led it to assess with moderate confidence that a Russian threat actor operated the“verification. google” branch. The researchers stopped short of attributing the wider campaign to the same actor.</p><p>The findings add to evidence that Amatera is being distributed through several distinct delivery mechanisms. Microsoft has separately documented increased ACR Stealer activity involving ClickFix lures, WebDAV-delivered payloads, staged PowerShell, Python-based loaders and, in some cases, blockchain-backed dead-drop infrastructure for command-and-control resolution.</p>See also  FBI details QTFY platforms targeting US infrastructure <p>Security researchers have also previously linked ClearFake campaigns to EtherHiding, a technique in which attackers place malicious or redirecting code in blockchain smart contracts. Because blockchain data is decentralised and difficult for defenders to remove directly, the method can give operators a resilient way to alter or recover parts of an infection chain.</p><p>Talos said the browser-side“pf. ch” flow used the blockchain-backed script to deliver the fake verification step, after which the victim's own actions initiated execution. This makes the campaign heavily dependent on social engineering while allowing malicious code to pass through services and technologies that are normally trusted.</p><div class='code-block code-block-1'><h2></h2></div>

MENAFN10092026000152002308ID1111645440

Legal Disclaimer:
MENAFN provides the information “as is” without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the provider above.

Hackers Exploit CAPTCHA, Webdav And Blockchain To Steal Credentials Arabian Post

More Story