VodkaStealer
VodkaStealer is a custom C++ information stealer observed as a payload in a large ClickFix campaign that used compromised legitimate WordPress sites to target primarily Windows users. In the reported activity, attackers injected malicious JavaScript into WordPress sites and displayed fake Cloudflare human-verification/CAPTCHA prompts that instructed victims to paste commands into the Windows Run dialog, leading to a multi-stage, largely in-memory infection chain. Rapid7 reported the broader operation had been active in this form since December 2025, with some supporting infrastructure dating to July/August 2025, and identified more than 250 compromised websites across at least 12 countries. VodkaStealer was delivered alongside other payloads including Vidar Stealer, Impure Stealer, and the DoubleDonut loader. The malware family is described as capable of harvesting browser credentials, authentication cookies, cryptocurrency wallet data, and other sensitive information from infected devices. Rapid7 specifically described VodkaStealer as the latest payload observed at the end of the DoubleDonut chain. High-confidence associations in the provided content tie VodkaStealer to financially motivated malware distribution via ClickFix/social-engineering lures on compromised WordPress infrastructure; no specific threat actor attribution beyond that is provided.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
4 techniques
Credential Access
The payloads delivered include Vidar Stealer, Impure Stealer, VodkaStealer and the DoubleDonut loader - all capable of harvesting browser credentials, authentication cookies, cryptocurrency wallet data and other sensitive information from infected devices.
The payloads delivered include Vidar Stealer, Impure Stealer, VodkaStealer and the DoubleDonut loader - all capable of harvesting browser credentials, authentication cookies, cryptocurrency wallet data and other sensitive information from infected devices.
Collection
1 technique
Collection
IOCs tracked for this family
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A C++ stealer used as a payload in ClickFix campaigns delivered through compromised WordPress websites.
Information-stealing malware used in the described ClickFix campaign to collect browser credentials, authentication cookies, cryptocurrency wallet data and other sensitive information.
Information-stealing malware delivered via ClickFix through compromised WordPress sites; harvests browser credentials, authentication cookies, cryptocurrency wallet data and other sensitive information.
Custom C++ infostealer attributed to the same developer/operator as the DoubleDonut loader; performs RU/BY geofencing, anti-debug/VM checks, browser and wallet data theft, stages data in temp directories, and attempts to use ChromElevator to bypass Chrome App-Bound Encryption (noted as currently broken in the analyzed sample).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.