ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos describes an active, moderately sophisticated campaign delivering the Amatera stealer through WebDAV DLL execution and a Cloudflare Worker / BNB Smart Chain click-fraud chain; two loader branches (pf.ch and verification.google) deploy secondary payloads including ZigCryptoStealer (with a kernel driver to terminate EDR), a Go-based reverse proxy, and an unauthorized NetSupport Manager remote access client, with observed telemetry, IOCs, and moderate-confidence attribution for one branch to a Russian actor.