ClearFake’s fake CAPTCHA campaign shows how malware now evades trust

At a glance

What this is: ClearFake is a malware campaign that hides behind fake CAPTCHA prompts, blockchain-hosted payloads and trusted Windows features to evade conventional web security controls.

Why it matters: It matters because the campaign turns legitimacy itself into an evasion layer, which means IAM, endpoint and web controls need to account for trusted services being abused in the delivery chain.

Context

ClearFake is a web-delivered malware campaign, not just a malicious site. It compromises legitimate websites, injects JavaScript into pages and then uses fake CAPTCHA prompts to persuade users to run code themselves. The primary security gap is not lack of filtering alone, but the abuse of trust in browser content, Windows utilities and common internet services.

The article also shows how delivery-path legitimacy can defeat controls that rely on obvious malicious indicators. If the payload is pulled from a blockchain smart contract, hosted through a widely used CDN and executed through a trusted Windows script, perimeter reputation checks lose much of their value. That makes the campaign relevant to identity and endpoint governance because the user is manipulated into authorising execution through trusted local tooling, which is a classic trust-boundary failure.

Key questions

Q: What breaks when fake CAPTCHA campaigns use trusted Windows execution paths?

A: They break the assumption that endpoint controls can rely on suspicious files or domains as the primary signal. When a user is induced to launch a trusted Windows script or interpreter, the malicious action inherits legitimate context. Defenders have to control which local execution paths are allowed, not just which payloads are downloaded.

Q: Why is blockchain-based payload storage harder to remove than conventional malware hosting?

A: Because the payload lives on a distributed ledger rather than on a single compromised server. Defenders can take down a host, but they cannot easily erase an on-chain object that is replicated across the network. That gives attackers a durable retrieval source and makes disruption, not deletion, the realistic defence objective.

Q: What are the signs that a click-fix campaign is hiding inside normal web traffic?

A: Look for fake CAPTCHA pages, clipboard priming, unusual use of Win + R and scripted calls to public RPC or CDN services that do not fit the business context. The pattern often combines social engineering, browser activity and local execution in one chain, so isolated alerts are easy to miss.

Q: Should teams block public RPC endpoints and CDNs to stop malware delivery?

A: Only when the business does not need them, because these services are legitimate and broad blocking can create unnecessary disruption. A better approach is to inventory who uses them, create narrow exceptions and alert on unexpected combinations such as browser-initiated RPC calls followed by local script execution.

Technical breakdown

Fake CAPTCHA lures as social engineering delivery

ClickFix style lures work by turning the user into the execution path. The fake CAPTCHA tells the victim to press Win + R, paste a command and execute it, which shifts the attack from browser content into a local Windows runtime context. That matters because the browser is only the staging layer. Once the clipboard is primed, the attacker is no longer depending on a malicious download being clicked, but on the user invoking a legitimate OS feature that can launch scripts or interpreters. The campaign also avoids immediate re-infection by tracking UUIDs, which shows operational discipline rather than opportunism.

Practical implication: block or restrict Win + R driven execution paths and train users that CAPTCHA challenges should never request clipboard commands.

EtherHiding and blockchain-hosted payload retrieval

EtherHiding stores malicious JavaScript in a smart contract and retrieves it at runtime through blockchain RPC calls. Because the blockchain is immutable and public, the actor gains a takedown-resistant staging layer that can be updated without changing the compromised site’s visible behaviour. The loader decodes the retrieved payload and executes it dynamically, which makes static scanning much less effective. This also splits responsibility across multiple legitimate services, so defenders see ordinary RPC traffic, ordinary CDN traffic and ordinary browser behaviour instead of a clearly malicious domain. The result is a delivery chain designed to survive URL blocklists and rapid infrastructure takedown.

Practical implication: monitor and, where appropriate, restrict access to blockchain RPC endpoints that your business does not need.

Proxy execution through trusted Windows components

The campaign’s newer stage abuses SyncAppvPublishingServer.vbs, a legitimate Windows script, to launch PowerShell through command injection. That is proxy execution in practice: the attacker does not need a malicious binary when a trusted component can be coerced into running attacker-controlled commands. This is especially hard for EDR products that key on obvious PowerShell launch patterns, because the parent process and command context look partially legitimate. The article also notes the move to jsDelivr for hosting malicious code, which further blends the chain into normal enterprise traffic. The technique is less about raw malware and more about abusing signed, trusted and widely used execution paths.

Practical implication: constrain or block the specific Windows scripts and PowerShell launch paths that are not required for business operations.

Threat narrative

Attacker objective: The attacker’s objective is to run malware on victim endpoints while hiding delivery behind legitimate websites, blockchain infrastructure, CDN traffic and trusted Windows execution paths.

1. Entry begins when a compromised website injects ClearFake JavaScript into normal page content and presents a fake CAPTCHA to the visitor.
2. Credential or execution abuse follows when the user is tricked into pasting a clipboard command into the Windows Run dialog, which invokes trusted local tooling rather than an obvious malware file.
3. Escalation occurs through blockchain-hosted payload retrieval, CDN hosting and proxy execution via a legitimate Windows script that runs PowerShell with attacker-supplied arguments.
4. Impact is the execution of malicious code on the victim system while traditional domain reputation and signature-based controls miss the chain because each step uses a trusted service or feature.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ClearFake is a trust-abuse campaign, not just a malware campaign. Its real innovation is not the lure alone, but the way it composes multiple legitimate layers into one delivery path. Browser content, blockchain payload storage, public RPC endpoints, CDNs and Windows utilities each appear normal in isolation, which is why point controls miss the full picture. Practitioners need to evaluate trust boundaries as a chain, not as separate filters.

Blockchain-backed malware hosting creates a new persistence problem for defenders. When payloads live in smart contracts, takedown becomes harder and attribution signals become noisier. That does not make the blockchain malicious by itself, but it does turn public decentralised infrastructure into a durable staging layer that traditional web filtering was never designed to govern. The governance lesson is that availability assumptions can become attacker advantages when controls depend on revocable URLs.

ClearFake illustrates a named concept: delivery-chain legitimacy abuse. The campaign succeeds by making every hop look like something a security team would normally trust, from jsDelivr to Windows scripting. That creates a distinct detection problem because telemetry must correlate the sequence, not just inspect each event in isolation. Security programmes that still rely on destination blocklists are behind this pattern.

Proxy execution through living-off-the-land components shifts the control point to execution governance. The campaign does not need admin rights or custom loaders when it can hijack a built-in script path to launch PowerShell. That is why endpoint policy, application control and command-line scrutiny matter more than post-execution malware hunting alone. The practical takeaway is to govern which trusted components are allowed to start which interpreters.

For identity and access programmes, this is a human trust failure as much as a technical one. The user is manipulated into authorising local execution through a familiar browser prompt, which bypasses the normal caution people reserve for files and attachments. That means awareness training, browser hardening and execution controls all have to align. The reader should treat user-mediated execution as part of the identity boundary.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Delivery-chain legitimacy abuse is becoming the more important detection problem. The campaign works because each stage looks trustworthy on its own. Security teams should therefore correlate browser content, clipboard activity, script launch telemetry and egress destinations, rather than relying on one malicious indicator.

Endpoint policy now needs to govern trusted utilities more aggressively. Built-in Windows scripts and script interpreters are high-value abuse paths because they let attackers inherit legitimacy. The practical shift is from hunting malware files to constraining what trusted binaries are allowed to do in the first place.

For practitioners

• Restrict clipboard-to-run execution paths Prevent or monitor Win + R workflows that accept pasted commands from the clipboard, especially when the command launches scripting engines or interpreters. The fake CAPTCHA pattern depends on user-mediated execution, so shrinking that path reduces the campaign’s success rate.
• Control trusted Windows script abuse Block or tightly allowlist SyncAppvPublishingServer.vbs and similar built-in scripts if they are not required, and validate parent process and command-line arguments for approved uses only. The article shows that trusted system files can become proxy execution carriers.
• Monitor blockchain RPC and CDN use Watch for unusual requests to public blockchain RPC endpoints and to CDNs that are being used as payload hosts rather than ordinary library sources. If your organisation has no business need for those services, restrict them at the network edge with clear exceptions.
• Harden PowerShell launch governance Reduce non-system PowerShell execution wherever possible and use application control to limit which parent processes may start it. The campaign’s in-memory PowerShell usage shows that script execution policy needs to account for legitimate-looking parents, not only obvious malware binaries.

Key takeaways

• ClearFake shows how social engineering, blockchain storage and trusted Windows utilities can be chained to defeat conventional reputation-based controls.
• The article attributes close to 150,000 infections to the campaign’s public tracking smart contract, which shows the scale of the problem is already operational, not theoretical.
• The most effective defensive response is to govern execution paths, restrict unnecessary RPC and CDN exposure, and reduce trust in clipboard-driven user prompts.

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• EtherHiding: EtherHiding is a malware delivery technique that stores malicious payloads or payload references in a blockchain smart contract. The attacker uses the chain as a durable retrieval source, which makes takedown difficult and allows payload access without maintaining a traditional server.
• Proxy Execution: Proxy execution is the abuse of a trusted system utility or application to run malicious code indirectly. It hides attacker intent inside normal software behaviour, which weakens security tools that focus on suspicious binaries rather than the process path used to launch them.
• Living Off The Land Technique: Living Off The Land Technique is an attack method where an adversary uses tools already present in a target environment instead of introducing obvious malware. It relies on legitimate system utilities, scripts, admin features, and trusted services to blend in with normal activity, making detection harder and forensic separation from routine operations more difficult.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management for practitioners who need to connect identity control to broader security operations. It helps security and identity teams build the governance muscle needed for modern trust-boundary failures.