{"id":10053,"date":"2026-01-22T10:04:31","date_gmt":"2026-01-22T10:04:31","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/22\/new-clearfake-campaign-leveraging-proxy-execution-to-run-powershell-commands-via-trusted-window-feature\/"},"modified":"2026-01-22T10:04:31","modified_gmt":"2026-01-22T10:04:31","slug":"new-clearfake-campaign-leveraging-proxy-execution-to-run-powershell-commands-via-trusted-window-feature","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/22\/new-clearfake-campaign-leveraging-proxy-execution-to-run-powershell-commands-via-trusted-window-feature\/","title":{"rendered":"New ClearFake Campaign Leveraging Proxy Execution to Run PowerShell Commands via Trusted Window Feature"},"content":{"rendered":"

New ClearFake Campaign Leveraging Proxy Execution to Run PowerShell Commands via Trusted Window Feature
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

ClearFake has entered a new and more dangerous phase, turning a familiar fake CAPTCHA scam into a highly evasive malware delivery chain. <\/p>\n

Across hundreds of hacked websites, visitors now see what looks like a routine verification challenge, but behind the scenes the page is preparing to launch hidden code. <\/p>\n

Victims only need to follow simple keyboard steps, such as pressing Win + R and paste, for the attack to begin.<\/p>\n

This ClearFake wave matters because it blends social engineering<\/a> with so\u2011called living off the land tactics, abusing tools already built into Windows as a trusted Windows feature instead of dropping obvious malware files. <\/p>\n

By shifting its infrastructure onto blockchain smart contracts and a popular content delivery network, the operation also avoids many domain and IP blocklists that defenders rely on.<\/p>\n

Expel analysts and researchers identified<\/a> this latest evolution while tracking ClearFake\u2019s JavaScript framework across compromised sites and examining the new loader stages. <\/p>\n

The team linked the campaign to a traffic distribution system that has likely pushed malware to close to 150,000 systems, based on unique IDs stored in a public smart contract visible on the BNB Smart Chain test network. <\/p>\n

\n
\"A
A graph detailing the number of infections per day since the smart contract was created (Source \u2013 Expel)<\/figcaption><\/figure>\n<\/div>\n

ClearFake\u2019s operators use the Ethereum\u2011style contract as a resilient command center, updating encoded JavaScript<\/a> that infected pages fetch through public Web3 endpoints. <\/p>\n

Abusing a Trusted Windows Script for Proxy Execution<\/strong><\/h2>\n

This design, combined with hosting later\u2011stage payloads on jsDelivr, a widely used CDN, means every external touchpoint in the chain sits on services defenders are reluctant to block.<\/p>\n

The business impact is clear: a user completing what appears to be a harmless CAPTCHA can unknowingly grant attackers code execution on a trusted corporate endpoint, with little or no trace left on disk. <\/p>\n

From there, follow\u2011on payloads can steal data, deploy additional malware, or provide remote access, all while hiding behind normal\u2011looking network traffic and legitimate Windows components. <\/p>\n

\n
\"A
A map detailing the geographical distribution of systems infected in the past week (Source \u2013 Expel)<\/figcaption><\/figure>\n<\/div>\n

At the heart of the new technique is SyncAppvPublishingServer.vbs, a legitimate script in the Windows System32 folder that ships as part of App\u2011V management. <\/p>\n

\n
\"After
After the users click \u2018I\u2019m not a robot\u2019 they\u2019re presented with the social engineering lure (Source \u2013 Expel)<\/figcaption><\/figure>\n<\/div>\n

ClearFake\u2019s fake CAPTCHA<\/a> instructs users to open the Run dialog, where the clipboard holds a carefully crafted command that passes a malicious argument into this script.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post New ClearFake Campaign Leveraging Proxy Execution to Run PowerShell Commands via Trusted Window Feature<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

New ClearFake Campaign Leveraging Proxy Execution to Run PowerShell Commands via Trusted Window Feature ClearFake has entered a new and more dangerous phase, turning a familiar fake CAPTCHA scam into a highly evasive malware delivery chain. Across hundreds of hacked websites, visitors now see what looks like a routine verification challenge, but behind the scenes […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-10053","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10053"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10053"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10053\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}