Last Updated: 2026-09-09T04:42:20Z
What’s Happening
Cisco Talos has research on an ongoing ClearFake campaign with some familiar tactics.
This is quite similar to the last ClearFake sample we encountered. BNB Smart Chain, WebDAV DLL pulls, process hollowing, the works.
Actions
As always, blocking the BNB RPC nodes is a good move, and will neutralize this attack. Also, no WebDAV to the internet!
This campaign’s specific indicators have been added to MISP.
