Loading story…
Attackers compromised the Artlist WordPress subdomain new-blog.artlist[.]io and used it to deliver a sophisticated ClickFix malware campaign that presented visitors with a fake CAPTCHA and tricked them into running PowerShell. The injected JavaScript used an EtherHiding technique, querying a Polygon smart contract to dynamically retrieve the next-stage host auth-code-check[.]info, then downloaded a multi-stage infection chain from the attacker-controlled backend.
Researchers traced the intrusion to WordPress credentials stolen from an Israeli freelance developer whose machine had been infected by an infostealer after downloading a pirated copy of Adobe Acrobat Pro DC in 2023. The payload chain reportedly used a password-protected archive, a signed StruSoft/FEM-Design updater, and DLL side-loading to decode shellcode and load a final native RAT that supported encrypted and Tor-backed C2, browser credential theft, keylogging, clipboard and screen access, hidden desktop interaction, file transfer, shell and process control, SOCKS proxying, service installation, and in-memory PE delivery.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In mid-July 2026, visitors to new-blog.artlist[.]io were shown a fake CAPTCHA that tricked them into running a hidden PowerShell command. That downloader fetched additional staged components and ultimately installed a full-featured remote-access trojan with capabilities including credential theft, remote desktop, file transfer, and Tor/SOCKS-based C2 fallback.
Using the stolen WordPress credentials, attackers accessed the backend for new-blog.artlist[.]io and injected obfuscated JavaScript. The malicious code used an EtherHiding technique that queried a Polygon smart contract to retrieve the next-stage host auth-code-check[.]info.
In August 2023, an Israeli freelance WordPress developer downloaded a pirated copy of Adobe Acrobat Pro DC and was infected by an infostealer. The malware exposed saved WordPress credentials for Artlist, which researchers later linked to the subsequent compromise.
On 2026-07-14, researchers publicly documented the malicious injection on new-blog.artlist[.]io and analyzed the infection chain from EtherHiding through the final native RAT. The reporting also described the staged archive, DLL side-loading, shellcode and container parsing, and backend token behavior observed during artifact recovery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 350 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcetrojan-killer.net
Open sourceinfostealers.com
Open sourcemalware.news
Open sourcereddit.com
Open sourcederp.ca
Open sourcecommunity.gurucul.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026
Threat actors are scaling **ClickFix**-style “self-infection” attacks that abuse compromised legitimate websites to trick users into manually executing malicious PowerShell via the Windows Run dialog or a terminal. Reporting describes the **KongTuke** campaign evolving its tradecraft by retrieving next-stage instructions from **DNS TXT records** rather than over HTTP, reducing visibility for controls focused on web traffic and blending activity into normal DNS resolution. The objective is follow-on malware deployment and persistence, including installation of remote-access tooling such as the **Interlock RAT**. Separately, researchers described a large **watering-hole** operation dubbed **IClickFix** that poisoned **3,800+ WordPress sites** with a fake *Cloudflare Turnstile CAPTCHA* prompt that instructs visitors to copy/paste and run a “fix” command. Once executed, the staged PowerShell pulls commodity payloads including **NetSupport RAT**, **Emmenhtal Loader**, and **XFiles Stealer**, and uses tracking/targeting logic (e.g., an `ic-tracker-js` HTML tag) to manage victim flow. In contrast, a different WordPress compromise technique called **“directory shadowing”** was reported as an SEO-spam operation that creates physical folders matching WordPress permalinks and serves gambling content selectively to crawlers (via User-Agent checks), which is not part of the ClickFix execution chain.
Sep 3, 2026
Attackers turned a single **ClickFix** social-engineering lure into a multi-stage Windows intrusion that abused `pcalua.exe` to launch `mshta.exe`, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving **EtherHiding** infrastructure and **GULoader**, while Huntress documented a related intrusion in which an MSI dropped **Potemkin**, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called **RMMProject** entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading. The operators then established persistence with Run keys, scheduled tasks, and a renamed **Cloudflare Tunnel**, and deployed **EtherRAT**, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy **Chisel** reverse SOCKS tunnels, and used **WinRM**, **WMIExec**, and **SMBExec** for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.
Jul 12, 2026