New Execution Technique in ClearFake Campaign

ReliaQuest observed a ClearFake JavaScript framework campaign that tricks victims into manually pasting obfuscated PowerShell into a shell to fetch and execute additional stages, performing sandbox-evasion (CPU temperature check), DLL sideloading of a malicious MediaInfo DLL, and ultimately installing LummaC2 infostealer; the report includes case studies, IoCs (hashes, domains, IPs), and mitigation recommendations such as restricting PowerShell, applying WDAC/AMSI, network filtering, and user awareness.