ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

· Blog Talosintelligence · Sept. 8, 2026, 12:51 p.m.
Cisco Talos Antivirus Cisco Talos Malware Protection Threats Threat Spotlight Cybersecurity cryptocurrency malware web-security
Summary
This blog post discusses a non-targeted attack vector involving the ClearFake WebDAV infection chain that deploys multiple malware variants including Amatera stealer, ZigCryptoStealer, and NetSupport Manager. It highlights the connection to cryptocurrency and credentials theft, underscoring the broader implications of such cybersecurity threats.
Read full post on blog.talosintelligence.com →
AUTHOR
Advertise
Sponsor diff.blog
Put your product in front of developers who read and write about their craft. One exclusive sponsor at a time.
Become a sponsor →
BLOG POST FEATURED ON

Placeholder image
r/blueteamsec

3 points

Add this plugin to your blog