ClearFake is a threat cluster known for compromising legitimate websites and planting fake CAPTCHA lures that use ClickFix-style social engineering decoys. It distributes malware such as WordlistLoader and Amatera Stealer via WebDAV servers. The group has been highlighted by Microsoft and Gen Threat Labs.