Topic starter
20/08/2026 5:32 pm
TL;DR: ClearFake has evolved into a large-scale social engineering campaign that injects fake CAPTCHA lures into compromised websites, uses blockchain-hosted payloads, and abuses trusted Windows execution paths to evade security tools, according to Expel. The case shows that domain blocking and signature-based detection are no longer enough when attackers chain legitimate services into the delivery path.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “ClearFake gets more evasive with new living off the land (LOTL) techniques”.
Key questions
Q: What breaks when fake CAPTCHA campaigns use trusted Windows execution paths?
A: They break the assumption that endpoint controls can rely on suspicious files or domains as the primary signal.
Q: Why is blockchain-based payload storage harder to remove than conventional malware hosting?
A: Because the payload lives on a distributed ledger rather than on a single compromised server.
Q: What are the signs that a click-fix campaign is hiding inside normal web traffic?
A: Look for fake CAPTCHA pages, clipboard priming, unusual use of Win + R and scripted calls to public RPC or CDN services that do not fit the business context.
Practitioner guidance
- Restrict clipboard-to-run execution paths Prevent or monitor Win + R workflows that accept pasted commands from the clipboard, especially when the command launches scripting engines or interpreters.
- Control trusted Windows script abuse Block or tightly allowlist SyncAppvPublishingServer.vbs and similar built-in scripts if they are not required, and validate parent process and command-line arguments for approved uses only.
- Monitor blockchain RPC and CDN use Watch for unusual requests to public blockchain RPC endpoints and to CDNs that are being used as payload hosts rather than ordinary library sources.
Bottom line: ClearFake shows how social engineering, blockchain storage and trusted Windows utilities can be chained to defeat conventional reputation-based controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:19 pm
ClearFake is a trust-abuse campaign, not just a malware campaign. Its real innovation is not the lure alone, but the way it composes multiple legitimate layers into one delivery path. Browser content, blockchain payload storage, public RPC endpoints, CDNs and Windows utilities each appear normal in isolation, which is why point controls miss the full picture. Practitioners need to evaluate trust boundaries as a chain, not as separate filters.
A few things that frame the scale:
- 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.
A question worth separating out:
Q: Should teams block public RPC endpoints and CDNs to stop malware delivery?
A: Only when the business does not need them, because these services are legitimate and broad blocking can create unnecessary disruption. A better approach is to inventory who uses them, create narrow exceptions and alert on unexpected combinations such as browser-initiated RPC calls followed by local script execution.
👉 Read our full editorial: ClearFake’s fake CAPTCHA campaign shows how malware now evades trust