New Clearfake Variant Leverages Fake reCAPTCHA To Trick Users Deliver Malicious PowerShell Code

ClearFake is an evolving JavaScript-based malware framework that compromises websites (notably many WordPress sites) and uses blockchain-hosted smart contract code to hide malicious scripts. New variants (Dec 2024) present fake reCAPTCHA or Cloudflare Turnstile challenges that socially engineer users into running PowerShell commands, delivering loaders and infostealers (Lumma, Vidar); researchers reported over 9,300 compromised sites, making mitigation and takedown more difficult.