INCIDENT EVIDENCE GRAPH

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

2026-09-08T10:01:07Z

We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.

• Victim: Users targeted by the ClearFake infection chain
• Method: ClearFake WebDAV infection chain delivering Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Primary evidence

1. ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

中文