One Block Ahead: Identifying ClearFake on the Blockchain

WEBINAR | 45 MINS

Save Your Seat
4400-1-Identifying-ClearFake-on-the-Blockchain-HubSpot-LP-hero-500x300@2x
Save Your Seat
elements

📅 Thursday, October 22, 2026 | 10:00am CT / 4:00pm BST


The ClearFake malware campaign hides its malicious payloads inside smart contracts on a public blockchain using the EtherHiding technique, making it nearly impossible to take down through conventional means. These attacks are actively infecting consumers and employees across a wide range of organizations and sectors, ultimately installing credential stealers that can lead to infiltration and major damage.

In this session, LevelBlue SpiderLabs VP of Security Research Ziv Mador, and Senior Security Research Manager Pawel Knapczyk turn the attacker’s own infrastructure against them, using that same on-chain data to identify real victims of an active campaign.

You'll learn

  • How ClearFake uses EtherHiding to distribute malicious payloads through the blockchain, largely unnoticed

  • How the actors keep operational costs low by using the testnet of the Binance network

  • How SpiderLabs used the attacker’s own on-chain data to identify real victims of an active campaign

  • What happens after infection: credential theft and the path to broader organizational damage

Speakers

Ziv Mador

Ziv Mador

VP, Security Research, LevelBlue SpiderLabs
Pawel Knapczyk

Pawel Knapczyk

Senior Security Research Manager, LevelBlue SpiderLabs
Karl Sigler

Karl Sigler

Moderator, Senior Research Manager, LevelBlue

Save Your Seat