Notifications
Clear all
Topic starter
20/08/2026 5:32 pm
TL;DR: ClearFake has evolved into a large-scale social engineering campaign that injects fake CAPTCHA lures into compromised websites, uses blockchain-hosted payloads, and abuses trusted Windows execution paths to evade security tools, according to Expel. The case shows that domain blocking and signature-based detection are no longer enough when attackers chain legitimate services into the delivery path.
NHIMG editorial — based on content published by Expel: ClearFake’s fake CAPTCHA campaign and its evolving delivery chain
Questions worth separating out
Q: What breaks when fake CAPTCHA attacks rely on the user to execute the payload?
A: Traditional malware controls lose much of their value when the victim becomes the execution engine.
Q: Why do trusted system tools make social-engineering malware harder to detect?
A: Trusted tools create plausible telemetry.
Q: How can security teams reduce the risk from blockchain-hosted malware payloads?
A: Teams should decide whether blockchain RPC access is actually necessary in their environment and block or tightly broker it if it is not.
Practitioner guidance
- Block or tightly control risky execution paths Restrict use of SyncAppvPublishingServer.vbs and similar proxy-execution utilities unless the business has a documented need.
- Harden PowerShell execution for non-system users Limit PowerShell usage to approved administrative contexts, then log and alert on interactive launches, encoded commands, and in-memory execution patterns.
- Detect fake CAPTCHA execution chains Look for browser sessions followed by clipboard writes, Run dialog launches, and immediate invocation of script interpreters or PowerShell.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact JavaScript infection chain, including the Base64 decoding and blockchain retrieval steps used to load payloads.
- The specific smart contract behaviour behind EtherHiding, including how the set() and get() functions support persistence.
- The full command-injection abuse path for SyncAppvPublishingServer.vbs and the surrounding PowerShell execution logic.
- The infection telemetry and indicators that help investigators map campaign spread and response scope.
👉 Read Expel's analysis of ClearFake's fake CAPTCHA malware chain →
ClearFake and ClickFix abuse: what security teams need to stop?
Explore further
20/08/2026 6:19 pm
ClearFake shows that trust abuse is now a delivery architecture, not just a lure. The campaign does not depend on one malicious domain or one infected file. It chains compromised websites, blockchain-hosted payloads, public RPC services, and trusted Windows utilities into a delivery path that looks ordinary at each hop. Security teams should read that as a warning that web, endpoint, and execution controls have to be evaluated as one trust chain, not as separate point defenses.
A question worth separating out:
Q: Who is accountable when social engineering turns a user into the execution layer?
A: Accountability sits across security awareness, endpoint engineering, and identity governance. If the control model assumes users will not be manipulated into pasting commands, the organisation has a gap. Frameworks such as NIST SP 800-53 and CIS Controls push teams toward enforceable execution restrictions, not awareness alone.
👉 Read our full editorial: ClearFake’s fake CAPTCHA campaign shows how malware now evades trust
