ClearFake

ClearFake is a threat activity cluster, first identified in 2023, associated with compromised websites that have malicious JavaScript injected to deliver malware via drive-by download techniques. It is widely described as a Fake Update actor and as a malicious JavaScript framework deployed on compromised sites. Reporting also states Google tracks the original group behind EtherHiding as UNC5142. ClearFake is known for social-engineering users into self-execution, especially through fake CAPTCHA lures and malicious copy-and-paste workflows described as paste-and-run, ClickFix, and fakeCAPTCHA. It has also used fake browser update decoys on compromised WordPress sites. Multiple reports describe ClearFake as an early adopter of paste-and-run as an initial execution technique, and later reporting states it adopted ClickFix in May 2024. Observed ClearFake delivery chains include luring victims into running PowerShell or MSHTA commands, including abuse of the signed Microsoft App-V script SyncAppvPublishingServer.vbs as a living-off-the-land proxy to fetch payloads. Infrastructure and tradecraft have been linked to redirects from compromised sites to fake verification pages and to use of trusted or legitimate services and CDNs, including jsDelivr; separate reporting attributes EtherHiding development and deployment to ClearFake. Payloads attributed in the provided content include Emmenhtal Loader, NetSupport RAT, Lumma Stealer/LummaC2, ArechClient2, and ACR Stealer. One report specifically describes an ongoing CLEARFAKE campaign using ClickFix to lure victims into running MSHTA commands that ultimately deploy Lumma Stealer. Another report says researchers suspected a ClickFix campaign distributing NetSupport RAT over ClearFake infrastructure. Victimology in the provided content is broad and opportunistic through compromised websites, though one report notes App-V-dependent ClickFix chains likely skew toward enterprise-managed Windows environments. Reporting cited here says ClearFake remained highly prevalent in 2026 threat telemetry, ranking in Red Canary top-threat reporting and being described as one of the many notoriously known Fake Update actors.