ClearFake Expands Fake CAPTCHA Scam Into Crypto-Stealing Malware That Disables Endpoint Defenses

Security researchers have identified a new malicious operation attributed to the group known as ClearFake. The campaign upgrades a long‑running fake CAPTCHA scam into a multi‑stage infection chain that both pilfers cryptocurrency assets and disables endpoint detection and response (EDR) tools, making the payload harder to spot.

Unlike earlier iterations that merely displayed bogus CAPTCHA challenges to lure victims into solving them, the latest version injects malicious code into compromised websites. When a visitor follows a seemingly innocuous prompt, a command line snippet is executed on the host machine. The command appears routine, but it triggers the download and installation of a driver that contains a known vulnerability.

The vulnerable driver is the linchpin of the attack. By exploiting the driver’s weakness, the malware gains kernel‑level privileges, allowing it to unload or terminate security agents running on the endpoint. This driver‑based approach sidesteps many traditional user‑mode defenses, effectively neutralizing antivirus and EDR products that would otherwise block the malicious components.

Once the security layer is suppressed, the payload proceeds to harvest sensitive data. It scans for cryptocurrency wallet files, private keys, and authentication tokens, exfiltrating them to command‑and‑control servers operated by the threat actors. In parallel, the malware captures login credentials entered on the compromised system, broadening the financial impact beyond digital assets.

The technique mirrors a broader trend in cybercrime where attackers leverage legitimate but vulnerable drivers to achieve persistence and privilege escalation. Security analysts note that such “driver‑based” attacks have risen as defenders harden user‑space protections, prompting malicious groups to seek more stealthy footholds in the operating system kernel.

Defenders are advised to patch the affected driver promptly, enforce strict application whitelisting, and monitor for anomalous driver loading events. Organizations that rely on web‑based content delivery should also consider sandboxing browser processes and employing network‑level filters to block suspicious script injections. Researchers will continue to track ClearFake’s activities, warning that the group may refine its tactics further as defensive measures evolve.