ClearFake WebDAV Chains Deliver Amatera, ZigCryptoStealer and Unauthorized NetSupport
Cisco Talos traced two ClearFake-related WebDAV infection chains delivering Amatera stealer. Follow-on payloads included ZigCryptoStealer, a reverse proxy, and an unauthorized NetSupport Manager installation.