ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

· Blog Talosintelligence · Sept. 8, 2026, 12:51 p.m.
Threats Threat Spotlight Cisco Talos Antivirus Cisco Talos Malware Protection Cybersecurity malware credential theft cryptocurrency
Summary
This blog post discusses a non-targeted attack vector involving the ClearFake WebDAV infection chain that deploys multiple malware variants including Amatera stealer, ZigCryptoStealer, and NetSupport Manager. It highlights the connection to cryptocurrency and credentials theft, underscoring the broader implications of such cybersecurity threats.
Read full post on blog.talosintelligence.com →
AUTHOR
Advertise
Sponsor diff.blog
Put your product in front of developers who read and write about their craft. One exclusive sponsor at a time.
Become a sponsor →
BLOG POST FEATURED ON

Placeholder image
r/blueteamsec

3 points

Add this plugin to your blog