In April 2026, a machine at a Ukrainian government organization ran a file called verification.google. It was not a Google component, it was not even on the machine, and it was loaded straight off a remote server.
Vanja Svajcer of Cisco Talos pulled that thread and ended up reconstructing an entire infection chain, published in Talos research this week. Talos assesses with moderate confidence that the attacks were not aimed at any particular organization, and are part of a cryptocurrency and credential stealing operation built around the Amatera stealer, also tracked as ACR. Talos tracks the actor behind the verification.google activity as UAT-10820.
A file that ran from somebody else's server
The suspicious execution used WebDAV, a protocol that lets Windows treat a remote web server as a normal file path. The victim's machine started the WebClient service and ran the remote DLL through the 32-bit version of rundll32.exe, calling it by ordinal number rather than by name. Nothing malicious was written to disk first, which is much of the appeal. Hunting for the same pattern led Talos to a second loader, named pf.ch, and this one came with its whole delivery chain intact.
Why the code lives on a blockchain
The pf.ch chain starts on a compromised website, where a malicious Cloudflare Worker injects ClearFake JavaScript into the page. That script does not fetch its next stage from a server the defenders can seize. It queries a smart contract on the BNB Smart Chain testnet through a public node, reads encoded JavaScript out of it, and evaluates the result. The technique is known as EtherHiding, and it turns a public blockchain into bulletproof hosting: the operator can change the stored payload whenever they like, and nobody can take the contract down.
The script checks whether the browser is real rather than automated, works out the operating system, and pulls a different contract for Windows than for macOS. On Windows it draws a fake Google CAPTCHA-style checkbox over the compromised page and tells the visitor to open the Run dialog, paste what is on their clipboard, and press Enter. That is a ClickFix lure, and the pasted command quietly opens a WebDAV path on a randomized subdomain of leaguejazire[.]com and executes pf.ch. The same social engineering shape turned up when fake fix prompts were used to spread ACR Stealer, and fake game downloads delivered Amatera through EtherHiding in July.
Two branches, two different endings
Both loaders delivered Amatera, but their command-and-control servers asked for different follow-ups. The pf.ch branch received a DLL side-loading package in which a legitimately signed Chrome component loads a malicious NativeAOT DLL named secur32.dll. That DLL runs ZigCryptoStealer and uses a vulnerable driver to shut down endpoint security software. A separate shellcode loader carrying a Go-based reverse TCP proxy arrived alongside it.
The verification.google branch, the one seen on the Ukrainian government machine, instead got a PowerShell script that installs an unauthorized copy of NetSupport Manager, a legitimate remote control product that attackers regularly repurpose as a backdoor. Its configuration pointed at a command server on a Russian IP address, and on that basis Talos assesses with moderate confidence that this branch was operated by a Russian threat actor. Talos rates the two chains as identical only with low to medium confidence, so treat that link as provisional. Ukraine has absorbed a steady run of this kind of activity, as our country profile records.
Block WebDAV, and teach one rule about the Run box
Disable the WebClient service where it is not needed, and alert on rundll32.exe executing from a UNC path, which is rare in normal use and cheap to detect. Then teach the single rule that breaks every ClickFix campaign: no legitimate website, CAPTCHA or error page ever asks you to paste a command into the Windows Run dialog.
Reported indicators include the payload hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js, hxxps://phys[.]stunned-amniotic[.]com/hub[.]log, a staging page at hxxps://telegra[.]ph/Functions-04-03, and the addresses 145[.]249[.]109[.]147, 45[.]150[.]34[.]2 and 212[.]118[.]56[.]166.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.