MALWARE FAMILY

ClearFake

Internal ID: js.clearfake

aliases

Last seen:Mar 17, 2026

Intelligence Profile

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.

Threat Analysis

ClearFake is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.morphisec.com/coinlurker-the-stealer-powering-the-next-generation-of-fake-updates

→https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/

→https://rmceoin.github.io/malware-analysis/clearfake/

→https://www.kroll.com/en/insights/publications/cyber/clearfake-update-tricks-victim-executing-malicious-powershell-code

Quick Facts

TypeMalware Family

Aliases1

Also Known As

js.clearfake

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ClearFake