Loading story…
Threat actors used compromised legitimate websites—especially WordPress sites—to display fake CAPTCHA or browser-verification prompts that trick visitors into manually running malicious commands, resulting in information-stealer infections. Kroll reported that the CLEARFAKE campaign evolved from fake browser updates to a ClickFix-style technique in which victims copy, paste, and execute malicious PowerShell, while CyberCX linked a similar DarkEngine operation to at least 2,353 likely compromised WordPress sites after attackers allegedly stole administrator credentials through SEO-poisoned phishing pages and fake WP Engine logins.
The campaigns relied on injected JavaScript and increasingly evasive delivery methods, including EtherHiding, which retrieves attacker-controlled code from the BNB Smart Chain through blockchain-related endpoints. Observed payloads decoded obfuscated content, downloaded follow-on malware, and performed discovery and credential theft, while NJCCIC said related ClickFix activity installed MonsterV2 and could also deliver StealC or Rhadamanthys. Stolen data included browser information, account credentials, cryptocurrency wallets, and other sensitive personal information, showing how fake verification prompts on trusted sites are being used as an effective malware-delivery channel.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Kroll observed a new CLEARFAKE technique in May 2024 that redirected victims to a fake error page and instructed them to copy, paste, and run malicious PowerShell from the Start Menu. The payload then flushed DNS, cleared the clipboard, and retrieved or downloaded additional malware components.
Kroll reported that CLEARFAKE, which originally targeted Windows users, expanded to macOS users in Q4 2023. The campaign continued using fake browser update prompts on compromised websites.
Kroll said the CLEARFAKE fake browser update campaign was initially identified in Q2 2023. The campaign used malicious JavaScript on compromised webpages to present fake browser update lures to Windows users.
NJCCIC reported a new iteration of the ClickFix phishing technique in which emails led victims to compromised legitimate websites displaying fake CAPTCHA overlays. If users followed the instructions, the MonsterV2 infostealer was downloaded and installed, with similar campaigns also capable of delivering StealC or Rhadamanthys.
CyberCX warned of a financially motivated campaign called DarkEngine that embedded fraudulent CAPTCHA prompts into compromised WordPress websites to infect visitors with malware such as information stealers and remote access tools. It also said it had been contacting affected organisations and advised administrators to review account activity and inspect sites for malicious injections.
CyberCX said it identified at least 2,353 likely compromised websites in the DarkEngine campaign, including 82 belonging to organisations in Australia and New Zealand. The campaign used SEO poisoning and fake WP Engine login pages to steal administrator credentials and inject fake CAPTCHA prompts into legitimate WordPress sites.
4 references tracked. Mallory keeps watching after this page renders.
prophetsecurity.ai
Open sourcecyber.nj.gov
Open sourcesecuritybrief.com.au
Open sourcekroll.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors covertly compromised **250+ legitimate WordPress websites**—including small businesses, regional media outlets, and at least one **U.S. Senate candidate** campaign site—and used them as distribution points for an **infostealer** operation. Rapid7 reported that attackers injected malicious code into the compromised sites to display a convincing **fake Cloudflare CAPTCHA** page that instructs visitors to **copy and execute a command** on their own machines, leveraging the **ClickFix** social-engineering technique to initiate malware delivery. Once executed, the malicious command leads to installation of credential-stealing malware capable of exfiltrating **browser-stored credentials**, **authentication cookies**, and **cryptocurrency wallet data**, with stolen “logs” potentially monetized on cybercrime forums. Reporting indicates the campaign has been active since **December** and shows signs of **high automation** across unrelated WordPress instances; Rapid7 also noted attacker-controlled domains used in the operation were registered around **July–August**, and the firm said it **notified U.S. authorities** to support investigation and remediation.
Jul 1, 2026
Threat actors are increasingly using **fake CAPTCHA / verification pages** as a scalable social-engineering lure to deliver malware and steal credentials by abusing users’ trust in routine web security checks. Research highlighted a large, fragmented ecosystem of lookalike fake CAPTCHA pages hosted across **~9,494 compromised sites and malicious properties**, where roughly **70%** of observed pages share near-identical visuals while delivering **dozens of distinct payload variants** via different execution models, including clipboard-driven instructions that lead victims to run **PowerShell** or **VBScript** downloaders. Separately, a **ClickFix** campaign targeting Facebook users—especially content creators and businesses seeking verification—uses fake “verification” portals to trick victims into manually extracting and submitting browser session tokens (notably `c_user` and `xs`) via developer tools, enabling account takeover without exploiting software vulnerabilities. In parallel, the **ClearFake** campaign (a malicious JavaScript framework injected into hacked websites) has adopted ClickFix-style fake CAPTCHA lures and added more evasive “living off the land” behavior, including **proxy execution** to run PowerShell through trusted Windows features and shifting distribution to a **popular CDN**, reducing the effectiveness of defenses that rely primarily on blocking known-bad domains/IPs.
Jun 29, 2026
A wave of **social-engineering-driven malware delivery** is abusing “verification” and “fix” workflows to trick users into running attacker-supplied commands that install information stealers. LevelBlue reported a campaign using **fake Cloudflare-style CAPTCHA pages** on compromised websites to convince Windows users to manually execute malicious **PowerShell** commands, resulting in **StealC** deployment; StealC is described as exfiltrating browser credentials, crypto wallet data, Steam and Outlook credentials, system information, and screenshots over **RC4-encrypted HTTP** to a C2 server. Intego also identified an evolved **ClickFix** technique on macOS (“**Matryoshka**”) that leverages **typosquatting** to redirect users to pages instructing them to paste “fix” commands into Terminal; the loader then retrieves an AppleScript payload to steal browser credentials and target wallet apps (e.g., *Trezor Suite*, *Ledger Live*), including repeated fake password prompts as a fallback. Separately, other credential-theft campaigns are also leaning heavily on lures that exploit user trust and routine workflows. Morphisec described **Noodlophile** evolving from fake AI video platform ads to **fake job postings** and phishing “assessments,” delivering multi-stage stealers/RATs via techniques including **DLL sideloading**, while continuing to use **Telegram bots** for exfiltration/C2 and adding file-bloating content intended to disrupt automated analysis. These developments reinforce that user-in-the-loop execution (copy/paste commands, “verification” steps, and recruitment-themed forms) remains a high-yield initial access vector for stealers across both Windows and macOS environments.
Jun 29, 2026