Loading story…
A cybercrime campaign compromised more than 5,400 primarily small-business WordPress and PrestaShop websites to serve ClickFix malware lures. Injected scripts use EtherHiding to retrieve payloads and configuration from smart contracts through BNB Smart Chain (BSC) Testnet RPC endpoints, providing attacker infrastructure that is difficult to remove and can be remotely updated. Visitors receive a fake CAPTCHA instructing them to paste a PowerShell command into the Windows Run dialog, causing malware to be downloaded and executed.
The operators later replaced the ClickFix delivery chain with a WebRTC data-channel stager that connects to a hardcoded command-and-control server and dynamically executes JavaScript in browser memory. Researchers observed more than 300 infected sites active daily; nearly 400 sites contacted BSC Testnet endpoints each day in August, peaking at 536.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Netskope Threat Labs published an analysis reporting that the EtherHiding campaign had compromised more than 5,400 websites and affected more than 2,200 organizations worldwide. The report detailed that the WebRTC stager uses hardcoded C2 connection parameters, steals a legitimate CSP nonce, and executes streamed code in browser memory.
Cisco Talos identified WebDAV-based execution of a disguised DLL named verification.google at a Ukrainian government organization. Talos linked the activity to UAT-10820 and a ClearFake/EtherHiding ClickFix chain delivering Amatera, with observed branches also deploying ZigCryptoStealer or unauthorized NetSupport Manager remote-access software.
A ClearFake crypto-stealer branch abused the signed Chrome component platform_experience_helper.exe to side-load a malicious Secur32.dll loader, which launched ZigCryptoStealer and the signed vulnerable DCRCVDrv.sys driver. The driver was used in a BYOVD attack to terminate security-product and EDR processes, while ZigCryptoStealer hijacked cryptocurrency wallet addresses from the clipboard.
Cisco Talos assessed with moderate confidence that the UAT-10820 verification.google WebDAV activity against a Ukrainian government organization was conducted by a Russian threat actor. The assessment cited the Russia-based IP address used by the NetSupport Manager gateway, while noting the reused NetSupport license was not uniquely identifying.
Researchers observed nearly 400 compromised websites contacting BNB Smart Chain Testnet RPC endpoints each day in August, with a daily peak of 536 sites. More than 300 infected websites were active per day, and endpoint contact volume had risen steadily since spring.
Later in the campaign, the threat actor replaced the blockchain-hosted ClickFix payload with a WebRTC data-channel stager. The stager obtains JavaScript from a hardcoded command-and-control address and dynamically executes it in browser memory.
A cybercriminal operation compromised more than 5,400 primarily WordPress and PrestaShop websites, injecting scripts that use BNB Smart Chain Testnet smart contracts to deliver EtherHiding-hosted ClickFix lures. Visitors were shown a fake CAPTCHA directing them to run a PowerShell command that downloads and executes a payload.
Blackpoint SOC identified a Fake CAPTCHA campaign that persuades users to run a command through the Windows Run dialog and abuses the signed App-V SyncAppvPublishingServer.vbs script to proxy PowerShell execution. The chain uses execution gates, Google Calendar-hosted configuration, PNG LSB steganography, and in-memory shellcode execution to deliver Amatera Stealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
10 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcemkd-cirt.mk
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceblackpointcyber.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and Italy’s national cyber agency warned of active **ClickFix** and **TerminalFix** malware campaigns that trick users into manually launching malicious Windows commands from fake CAPTCHA or verification pages. The activity relies on compromised legitimate websites, including WordPress sites, where obfuscated JavaScript redirects visitors to prompts telling them to open **Run**, **Windows Terminal**, or **PowerShell** and paste attacker-supplied commands. Those commands abuse trusted Windows utilities such as `powershell.exe`, `cmd.exe`, `mshta.exe`, `rundll32.exe`, `msiexec.exe`, `curl.exe`, WMI, WebDAV, and scheduled tasks to download follow-on payloads, establish persistence, and contact attacker infrastructure. Researchers said the operators are using **EtherHiding** to conceal parts of their delivery chain inside smart contracts on public blockchains, including **BNB Smart Chain** and **Polygon**, which are queried through RPC gateways to retrieve configuration or malicious instructions. WatchGuard linked one cluster to the **ErrTraffic** malware-as-a-service operation and reported delivery of payloads including **Vidar**, **Okobot**, **ClipBanker** variants, **BabaDedaLoader**, Node.js backdoors, OnionDrop-related malware, and LegionLoader-linked samples. The campaign is aimed at credential theft, browser and cookie harvesting, cryptocurrency-wallet theft, defense evasion, lateral movement, and staging for broader compromise, prompting defenders to tighten command-line controls, increase PowerShell and endpoint monitoring, isolate affected hosts, and reset exposed accounts.
Aug 11, 2026
Threat actors used compromised legitimate websites—especially **WordPress** sites—to display fake CAPTCHA or browser-verification prompts that trick visitors into manually running malicious commands, resulting in information-stealer infections. Kroll reported that the **CLEARFAKE** campaign evolved from fake browser updates to a **ClickFix-style** technique in which victims copy, paste, and execute malicious PowerShell, while CyberCX linked a similar **DarkEngine** operation to at least **2,353** likely compromised WordPress sites after attackers allegedly stole administrator credentials through SEO-poisoned phishing pages and fake **WP Engine** logins. The campaigns relied on injected JavaScript and increasingly evasive delivery methods, including **EtherHiding**, which retrieves attacker-controlled code from the **BNB Smart Chain** through blockchain-related endpoints. Observed payloads decoded obfuscated content, downloaded follow-on malware, and performed discovery and credential theft, while NJCCIC said related ClickFix activity installed **MonsterV2** and could also deliver **StealC** or **Rhadamanthys**. Stolen data included browser information, account credentials, cryptocurrency wallets, and other sensitive personal information, showing how fake verification prompts on trusted sites are being used as an effective malware-delivery channel.
Aug 15, 2026
Threat actors are scaling **ClickFix**-style “self-infection” attacks that abuse compromised legitimate websites to trick users into manually executing malicious PowerShell via the Windows Run dialog or a terminal. Reporting describes the **KongTuke** campaign evolving its tradecraft by retrieving next-stage instructions from **DNS TXT records** rather than over HTTP, reducing visibility for controls focused on web traffic and blending activity into normal DNS resolution. The objective is follow-on malware deployment and persistence, including installation of remote-access tooling such as the **Interlock RAT**. Separately, researchers described a large **watering-hole** operation dubbed **IClickFix** that poisoned **3,800+ WordPress sites** with a fake *Cloudflare Turnstile CAPTCHA* prompt that instructs visitors to copy/paste and run a “fix” command. Once executed, the staged PowerShell pulls commodity payloads including **NetSupport RAT**, **Emmenhtal Loader**, and **XFiles Stealer**, and uses tracking/targeting logic (e.g., an `ic-tracker-js` HTML tag) to manage victim flow. In contrast, a different WordPress compromise technique called **“directory shadowing”** was reported as an SEO-spam operation that creates physical folders matching WordPress permalinks and serves gambling content selectively to crawlers (via User-Agent checks), which is not part of the ClickFix execution chain.
Sep 3, 2026