Multi-Stage Malware Operation Unveiled
A complex malware operation has recently come to light, engaging multiple tactics that involve fake Google CAPTCHA prompts, execution of DLL files hosted on WebDAV, malevolent Cloudflare Workers, and the use of BNB Smart Chain smart contracts. This operation is responsible for deploying what is known as the Amatera information stealer malware, which primarily focuses on credential theft and cryptocurrency-related scams.
The initial detection of this cyber threat can be traced back to April 2026. It was during this period that a Ukrainian government organization unknowingly executed a disguised Dynamic Link Library (DLL) file named “verification.google.” This was executed via a WebDAV path using the 32-bit utility known as rundll32.exe. This alarming discovery raised suspicions about a larger operation linked to cryptocurrency and credential theft rather than a targeted attack against the Ukrainian institution specifically.
Cisco Talos, a leading threat intelligence organization, has classified the activities associated with the “verification.google” variant under the identifier UAT-10820. Their assessment yields moderate confidence that this particular branch is operated by Russian threat actors, corroborated by the infrastructure infrastructure associated with NetSupport Manager command-and-control operations.
An investigation into the execution of the initial WebDAV file led researchers to discover a related loader known as “pf.ch,” which unveiled the complete delivery sequence of the malware. The sequence initiates with compromised websites, wherein a malicious Cloudflare Worker introduces a javascript known as ClearFake. This code does not rely on conventional attacker-hosted servers for each stage; instead, it retrieves obfuscated payloads directly from BNB Smart Chain contracts.
This innovative method, referred to as EtherHiding, allows operators to update the malformed JavaScript found within the smart contract data without needing to alter the compromised site itself. During this specific campaign, the preliminary script queries a BNB Smart Chain testnet contract identified by the address 0x886d310Ac23e05EA705e24E513D19f53793832A9. It then distinguishes between Windows and macOS-specific contracts based on the operating system of the user visiting the site.
Upon visiting the compromised site, victims are prompted to press Windows+R, then paste clipboard content to execute the command. This technique known as ClickFix effectively turns the victim’s machine into a tool for executing the malware while bypassing various standard drive-by attack protections. The command launched opens a WebDAV UNC path hosted on a random subdomain of leaguejazire[.]com, subsequently executing the loader pf.ch through rundll32.exe.
Notably, both the original “verification.google” sample and the pf.ch loader share similar execution patterns, signifying a closely related chain of attack. Ultimately, both loaders aim to deploy Amatera, known also as ACR Stealer, a family of malware that specifically targets credentials and cryptocurrency assets.
The pf.ch loader employs an intricate combination of techniques, including exception-driven control flow, API hashing, XOR decryption, LZNT1 decompression, and the use of Windows fibers to unpack its malicious payload directly in memory. In contrast, the “verification.google” variant employs direct WoW64 syscalls and DLL hollowing, which maps a clean dbghelp.dll image before substituting its executable code with malicious commands.
Google CAPTCHA Abuse
Talos has uncovered a vast scope of collection capabilities within this malware operation. The configuration for the “verification.google” variant of Amatera contains more than 400 targeted collection entries focusing on sensitive information from various applications such as browsers, messaging applications, cryptocurrency wallets, password managers, email clients, and VPN clients.
Among the applications targeted are popular services like Telegram, Signal, WhatsApp, KeePass, Bitwarden, 1Password, FileZilla, NordVPN, and AnyDesk. Talos researchers have indicated that for Windows users, the script conducts headless-browser checks, assigns a unique identifier to victims, and overlays a fraudulent Google CAPTCHA-style verification prompt.
The malware also actively scans users’ Desktop, Downloads, Documents, and Recent Items folders for sensitive information such as private keys, wallet backups, API tokens, OAuth materials, and password databases, including file types like .kdbx, .p12, .pfx, and .pem. This particularly jeopardizes users involved in cryptocurrency transactions, as well as enterprise administrators, placing them at significant risk.
After establishing command-and-control communications, the operation reveals its divergent paths. The pf.ch branch downloads a ZIP archive that contains a legitimate component for Google Chrome, which subsequently loads a malicious NativeAOT secur32.dll file. This DLL is capable of observing clipboard actions and replacing cryptocurrency wallet addresses with those controlled by the attackers.
Additionally, the operation deploys a signed but vulnerable driver that can terminate end-point detection and response (EDR) mechanisms through a kernel-mode process management capability. A separate payload, which operates resident in memory, transforms affected Windows systems into Go-based reverse TCP proxies. This functionality enables attackers to maintain covert access to the network and relay capabilities post-compromise.
Meanwhile, the “verification.google” branch retrieves a PowerShell payload designed to install an unauthorized NetSupport Manager remote-access instance. This aspect of the campaign points toward infrastructure linked to Russian IP address ranges, thus informing Talos’ assessment regarding the involvement of Russian threat actors.
For organizations, it is recommended to investigate any executions of rundll32.exe emerging from WebDAV UNC paths, particularly focusing on instances involving non-DLL filenames like pf.ch or verification.google invoked by ordinal. Precautions should be taken to limit unnecessary use of WebClient services, monitor for any suspicious activities related to pushd or WebDAV, and educate users on the fact that authentic CAPTCHA pages do not require them to input commands via Windows Run or Terminal.
Security teams should also scrutinize any unauthorized modifications made to Cloudflare Workers on their sites, look for connections established with BNB Smart Chain RPC endpoints by browser processes, and watch for any unsigned or unusual secur32.dll files loaded by Google Chrome executables, alongside unauthorized installations of NetSupport Manager.
This emerging campaign serves as a stark reminder of the dangers posed by sophisticated social engineering tactics and the ever-evolving landscape of malware attacks that leverage decentralized infrastructure.