ClickFix Social-Engineering Campaigns Using Compromised WordPress Sites and DNS-Based Staging

Threat actors are scaling ClickFix-style “self-infection” attacks that abuse compromised legitimate websites to trick users into manually executing malicious PowerShell via the Windows Run dialog or a terminal. Reporting describes the KongTuke campaign evolving its tradecraft by retrieving next-stage instructions from DNS TXT records rather than over HTTP, reducing visibility for controls focused on web traffic and blending activity into normal DNS resolution. The objective is follow-on malware deployment and persistence, including installation of remote-access tooling such as the Interlock RAT.

Separately, researchers described a large watering-hole operation dubbed IClickFix that poisoned 3,800+ WordPress sites with a fake Cloudflare Turnstile CAPTCHA prompt that instructs visitors to copy/paste and run a “fix” command. Once executed, the staged PowerShell pulls commodity payloads including NetSupport RAT, Emmenhtal Loader, and XFiles Stealer, and uses tracking/targeting logic (e.g., an ic-tracker-js HTML tag) to manage victim flow. In contrast, a different WordPress compromise technique called “directory shadowing” was reported as an SEO-spam operation that creates physical folders matching WordPress permalinks and serves gambling content selectively to crawlers (via User-Agent checks), which is not part of the ClickFix execution chain.