TF-MAL-js.clearfake
📛 Threat Title
Malware family: ClearFake
Description
ThreatFox malware family `js.clearfake`. Printable name: ClearFake.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.clearfake
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.clearfake
IOC database
- Type
- domain
- Value
js.clearfake- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.clearfake
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.clearfake
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.sekoia.io
ClearFake is a new malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. This blogpost aims at presenting a technical analysis of the ClearFake installation flow, the malware delivered by ClearFake , the C2 infrastructure and tracking opportunities.
-
web:cybernoz.com
The threat actors behind the ClearFake campaign are using fake reCAPTCHA or Cloudflare Turnstile verifications as lures to trick users into downloading malware such as Lumma Stealer and Vidar Stealer. ClearFake , first highlighted in July 2023, is the name given to a threat activity cluster that employs fake web browser update baits on compromised WordPress as a malware distribution vector. The ...
-
web:cybersecuritynews.com
Sekoia researchers noted that the ClearFake infrastructure includes over 9,300 compromised websites, with thousands of users potentially exposed to these malicious lures every day. The use of blockchain technology for malware delivery represents an emerging threat that makes traditional mitigation and blocking significantly more challenging.
-
web:expel.com
ClearFake's latest campaign uses fake CAPTCHAs and social engineering trick victims into installing malware , and it's getting more evasive.
-
web:malpedia.caad.fkie.fraunhofer.de
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.
-
web:rhisac.org
Context Sekoia researchers have released updates on ClearFake , a malicious JavaScript framework that infects compromised websites to deliver malware through drive-by downloads and social engineering tactics. Initially observed in July 2023, ClearFake utilized fake browser update prompts to trick users into downloading malware .
-
web:thehackernews.com
ClearFake malware infects 9,300+ websites, using fake reCAPTCHA and Web3 tactics to spread Lumma and Vidar Stealers, exposing 200,000+ users.
-
web:www.atea.no
IT-sikkerhet 10-01-2025 Investigating a ClearFake /ClickFix + Etherhide campaign Since the middle of December Atea IRT has identified and tracked a new campaign utilizing ClearFake and EtherHiding technique. The campaign infects legitimate websites resulting in an information stealer.
-
web:www.kroll.com
User awareness remains a key mitigation , ensuring users remain vigilant for fake captcha popups and understanding the threat from copy/pasting commands into the "run" box. Kroll continues to observe widespread attempted initial access through CLEARFAKE via fake CAPTCHA pop-ups across a wide range of industry sectors.
-
web:www.nocurity.com
A recent variant of the ClearFake malware framework has been identified, leveraging fake reCAPTCHA and Cloudflare Turnstile challenges to deceive users into executing malicious PowerShell commands. This evolution marks a significant escalation in the threat's capabilities, as it continues to exploit Web3 technologies for malware delivery.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.