ClearFake malware

ClearFake is a malicious JavaScript framework used to deliver malware through compromised websites. It works by injecting code into legitimate sites, most often compromised WordPress sites, and then tricking visitors into installing malware through a fake prompt, originally a fake web browser update and, more recently, a fake CAPTCHA verification. First seen in July 2023, it belongs to the broader "fake updates" category of threats and has become one of the most active web-based malware delivery frameworks, evolving quickly and adopting techniques such as hiding its payloads on the blockchain. The name ClearFake comes from the fact that its injected JavaScript was written in clear, unobfuscated text in early versions, unusual for this kind of malware. This entry explains what ClearFake is, how its infection chain works, how its lures and delivery have evolved, what malware it delivers, and how organizations detect and defend against it, drawing in part on first-party research by Sekoia's Threat Detection & Research (TDR) team, which analyzed the threat from its emergence.

Key takeaways

ClearFake is a JavaScript malware-delivery framework, injected into compromised websites to push malware onto visitors, not a piece of malware that runs on its own.
It relies on social engineering. It tricks users with fake browser updates and, since 2024, fake CAPTCHA prompts (the ClickFix technique) rather than exploiting a software flaw.
It compromises real websites, especially WordPress. Legitimate sites are compromised and used as watering holes, so people encounter the lure on sites they trust.
It hides payloads on the blockchain. Through a technique called EtherHiding, ClearFake stores code and instructions in blockchain smart contracts, which are hard to take down.
It delivers infostealers and loaders. The end goal is usually to install information stealers such as Lumma or Vidar, often through a loader, on Windows and increasingly macOS.

How ClearFake works

ClearFake is not malware that a user downloads directly. It is a delivery framework that turns a legitimate but compromised website into a trap. The infection chain follows a consistent set of stages, even as the specific lure and techniques change.

Stage		What happens
1	Website compromise	Attackers inject malicious JavaScript into a legitimate website, most often a vulnerable WordPress site, turning it into a watering hole that serves the lure to ordinary visitors.
2	Payload retrieval	The injected script fetches its next stage. Recent versions retrieve code and instructions from blockchain smart contracts (the EtherHiding technique) rather than a simple attacker server.
3	The lure	The visitor is shown a convincing fake prompt overlaying the page: originally a fake browser update for Chrome, Edge, or Firefox, and more recently a fake CAPTCHA verification.
4	User is deceived into acting	Following the prompt, the user either downloads a fake update file or, with the newer ClickFix lure, is guided into pasting and running a command that has been copied to their clipboard.
5	Malware installation	The action runs a loader that installs the final payload, typically an information stealer, while often also showing a real update or success message to avoid suspicion.

A defining trait is that ClearFake does not exploit a vulnerability in the visitor's computer. It relies on convincing the person to take an action themselves, which is why it works across up-to-date, fully patched systems. The compromised website simply provides a trusted-looking place for the lure to appear.

How ClearFake's lures have evolved

ClearFake has changed its social-engineering approach over time while keeping the same underlying framework:

Fake browser updates (2023). The original lure displayed a realistic copy of a Chrome, Edge, or Firefox update page, prompting the visitor to download a fake update that was actually malware. This placed ClearFake alongside other "fake updates" threats such as SocGholish.
Fake CAPTCHA and ClickFix (from 2024). ClearFake adopted the ClickFix technique, showing a fake CAPTCHA or verification page (imitating tools like reCAPTCHA or Cloudflare Turnstile) that instructs the user to prove they are human by running a command. The command is silently copied to the clipboard, and the user is guided into pasting it into a system dialog and running it, executing the malware themselves.

This shift matters because ClickFix moves the malicious action off a downloaded file and into a command the user runs, which can slip past defenses that focus on file downloads. The lure has continued to be refreshed frequently, with operators updating the framework, decoys, and payloads on an almost daily basis.

EtherHiding: Hiding payloads on the blockchain

One of ClearFake's most distinctive techniques is EtherHiding, which stores parts of the attack, such as JavaScript code, keys, lure content, and commands, inside smart contracts on a public blockchain, notably the Binance Smart Chain. The injected script on the compromised site simply reads this content from the blockchain when a visitor arrives.

This approach is a double-edged sword, as Sekoia's research has noted. For the attacker, it is resilient: content stored on a blockchain cannot easily be removed or taken down, and the attacker can rotate payloads without touching the compromised websites, using a legitimate, decentralized service to host malicious instructions. The trade-off is that the same openness means other threat actors can read, reuse, or even hijack the framework's infrastructure. For defenders, EtherHiding is significant because it sidesteps traditional takedowns and domain blocklists, moving part of the delivery chain onto infrastructure that is not controlled by any single provider.

What malware ClearFake delivers

ClearFake is a delivery mechanism, so the final payload varies with whatever its operators, or the actors using the framework, choose to distribute. In practice it has most often led to:

Loaders, such as HijackLoader (also linked to IDAT Loader) and Emmenhtal, which act as an intermediate stage that then installs the real payload.
Information stealers, the most common end goal, including Lumma, Vidar, Raccoon, and Stealc, which harvest credentials, session cookies, and other sensitive data.
macOS malware, with ClearFake observed delivering the AMOS stealer, showing that the threat is no longer limited to Windows.

Because the payloads it drops, particularly information stealers, can hand attackers credentials and access, a ClearFake infection is not only a problem for the individual machine. Stolen credentials can become the entry point for a wider intrusion or a ransomware attack, which is why the framework is treated as a serious initial-access threat rather than a nuisance.

Who is behind ClearFake

ClearFake is a financially motivated cybercriminal operation rather than a state-sponsored group. Its exact operators are not publicly named with certainty, and because the framework and its blockchain infrastructure can be reused, more than one actor may use it. Analysts have noted a significant overlap in tactics between ClearFake and SocGholish (tracked as TA569), including the use of watering holes, fake-update lures, the Keitaro traffic distribution system, and lookalike-character file names, which raised the question of a shared operator, though this is an assessment rather than a settled fact. Separately, some vendors track an evolution of the framework under other names, for example the loader designation CLEARSHORT and the activity cluster UNC5142, reflecting how the threat has branched and grown.

How to detect and defend against ClearFake

Because ClearFake depends on tricking users rather than exploiting software, defense combines user awareness with behavioral monitoring:

Teach the lure, not just the file. Users should know that legitimate browsers do not update through a website prompt, and that a genuine CAPTCHA never asks you to open a system dialog and run a command. Recognizing the ClickFix pattern is one of the strongest defenses.
Monitor for the ClickFix behavior. Watch for command interpreters such as PowerShell or the Windows scripting host being launched shortly after browser activity, and for clipboard-driven command execution, which are hallmarks of this technique.
Watch for the payloads. Detecting loader and information-stealer behavior, such as credential and cookie access and unusual outbound connections, catches the intrusion even when the initial lure succeeds.
Keep websites secure. For organizations that run their own sites, keeping content-management systems such as WordPress and their plugins patched reduces the chance of becoming a ClearFake distribution point.
Use threat intelligence and behavioral detection. Because ClearFake changes its lures, infrastructure, and payloads constantly, and hides parts of the chain on the blockchain, hunting for behaviors rather than fixed indicators is essential.

Sekoia's research on ClearFake

Sekoia's TDR team analyzed ClearFake from its emergence in 2023, publishing one of the early technical breakdowns of the framework's infection chain, the malware it delivered, and its command-and-control infrastructure, and noting the tactical overlap with SocGholish. In 2025, TDR followed up with an analysis of a widespread new variant, documenting the group's increased use of Web3 and the EtherHiding technique to store JavaScript, keys, lure URLs, and ClickFix commands on the Binance Smart Chain. In that research, Sekoia used the attackers' own blockchain wallet addresses as indicators to scan the web and identified more than nine thousand compromised websites serving the framework. This kind of sustained, first-hand tracking, published with indicators, is what lets defenders keep pace with a threat that updates itself daily.

Expert insight: When the user is the exploit

ClearFake is a clear example of a shift in web-based threats: the target of the attack is not a software flaw but the person at the keyboard. There is no vulnerability to patch, because the framework asks the user to install the malware or run the command themselves, on a fully updated machine, from a website they had no reason to distrust. Layer on payloads hidden in blockchain smart contracts, and the parts of the attack that defenders traditionally block, malicious domains, downloadable files, known exploits, are either absent or moved out of reach.

This is where a behavior-focused, intelligence-led approach earns its place, and where Sekoia's own work is instructive. Sekoia is a European cybersecurity vendor whose in-house TDR team has tracked ClearFake since it first appeared, including its move to Web3 payload hosting, and that intelligence feeds the platform. Rather than relying only on blocking known-bad files or domains, Sekoia's AI SOC platform correlates signals across endpoint, network, and web and maps them to the MITRE ATT&CK framework, so that the tell-tale chain, a browser session leading to a scripting-host launch leading to an information stealer reaching out, is recognized as one intrusion even when the lure and infrastructure are brand new. Sekoia's discovery of ClearFake's blockchain-based delivery is an example of turning first-hand intelligence into detection that keeps up with a fast-moving framework.

The practical takeaway for defenders is that a threat like ClearFake is caught by understanding behavior and context, not by matching a list of bad files. The decisive questions are behavioral: why did visiting a web page lead to a command prompt running a script, and why is that process now reaching out to steal credentials. Answering them depends on visibility across the whole chain, read against current intelligence on how the framework operates.