HOMETHREATSClearFake
APT / THREAT GROUP

ClearFake

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.

Threat Analysis

ClearFake is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning ClearFake

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet
Trend Micro Research· May 25, 2026

External References

→https://blog.morphisec.com/coinlurker-the-stealer-powering-the-next-generation-of-fake-updates
→https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/
→https://rmceoin.github.io/malware-analysis/clearfake/
→https://www.kroll.com/en/insights/publications/cyber/clearfake-update-tricks-victim-executing-malicious-powershell-code

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

ClearFakejs.clearfake

External Intelligence

Malpedia: js.clearfake

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search ClearFake