ClearFake Evolves. New Campaign Abuses Trusted Windows Features to Execute PowerShell
The ClearFake campaign has entered a new phase, shifting from simple fake CAPTCHA lures to a more evasive malware delivery technique.
Recent activity shows attackers abusing trusted Windows features to proxy the execution of PowerShell commands, reducing the need for traditional payloads and increasing stealth.
This evolution highlights how familiar social engineering campaigns continue to adapt by blending user interaction with native system functionality.
What has changed
Earlier ClearFake variants focused primarily on tricking users into downloading malicious files.
The latest campaign introduces proxy execution, where PowerShell commands are launched indirectly through legitimate Windows components.
This approach allows attackers to:
Avoid dropping obvious malicious binaries
Blend malicious activity into trusted system behavior
Reduce detection by endpoint security tools
Instead of relying on exploits, the attack depends on user trust and built-in Windows functionality.
Attack flow at a high level
Observed attack chains follow a consistent pattern:
A user is redirected to a fake CAPTCHA or verification page
Interaction triggers execution via a trusted Windows feature
PowerShell commands are executed indirectly
Additional payloads or scripts are fetched and run in memory
The result is code execution without obvious warning signs or suspicious files.
Why this technique is effective
Proxy execution through trusted components creates multiple defensive challenges:
Activity appears to originate from legitimate system processes
PowerShell usage may look consistent with normal administrative behavior
Traditional signature-based detection becomes less effective
This allows attackers to maintain a low operational footprint while achieving reliable execution.
The DIAMATIX Perspective
ClearFake’s evolution reinforces a recurring pattern in modern attacks.
When direct payload delivery becomes noisy, attackers pivot to living-off-the-land techniques that rely on trusted tools already present on the system.
Key takeaways:
User interaction remains a powerful entry point
Trusted Windows features are increasingly abused as execution proxies
Visibility into command execution context matters more than file-based detection
Organizations should focus on monitoring behavior, not just blocking binaries.
Conclusion
The latest ClearFake campaign demonstrates how well-known threats remain relevant by continuously refining their execution techniques.
As attackers rely more on native system features, defenders must adapt by prioritizing behavioral detection and execution control.
Trusted · Innovative · Vigilant
Sources
Public reporting on ClearFake campaign evolution
Technical analysis of proxy execution and living-off-the-land techniques
Microsoft documentation on PowerShell execution and Windows trusted components
Independent malware research on CAPTCHA-based social engineering campaigns
