ClickFix Campaign Hijacks WordPress Sites to Deliver Infostealers via Fake Cloudflare CAPTCHA
Malware Intelligence · 3 sources · Updated 4mo ago · First seen Mar 12, 2026
Threat actors covertly compromised 250+ legitimate WordPress websites—including small businesses, regional media outlets, and at least one U.S. Senate candidate campaign site—and used them as distribution points for an infostealer operation. Rapid7 reported that attackers injected malicious code into the compromised sites to display a convincing fake Cloudflare CAPTCHA page that instructs visitors to copy and execute a command on their own machines, leveraging the ClickFix social-engineering technique to initiate malware delivery.
Once executed, the malicious command leads to installation of credential-stealing malware capable of exfiltrating browser-stored credentials, authentication cookies, and cryptocurrency wallet data, with stolen “logs” potentially monetized on cybercrime forums. Reporting indicates the campaign has been active since December and shows signs of high automation across unrelated WordPress instances; Rapid7 also noted attacker-controlled domains used in the operation were registered around July–August, and the firm said it notified U.S. authorities to support investigation and remediation.
