FlagThis — Daily Cybersecurity Intelligence Briefing

A widespread cyberattack campaign has compromised over 5,400 WordPress websites to distribute multi-stage malware using the "ClickFix" social engineering technique. Attackers leverage critical RCE vulnerabilities in plugins—including CVE-2026-14894 (Super Forms) and CVE-2026-32475 (Elementor Pro)—to inject scripts that display deceptive Cloudflare CAPTCHAs or browser error prompts. These lures trick users into manually executing malicious PowerShell or Terminal commands. To ensure resilience, the campaign utilizes "EtherHiding," hosting payloads and C2 resolution on the Polygon and BNB Smart Chain blockchains. Impacted systems are infected with diverse payloads, including DeepLoad, KongTuke (ModeloRAT), and ACR Stealer, targeting both Windows and macOS environments for enterprise credential theft and network intrusion.

The Lunex Malware-as-a-Service (MaaS) platform is deploying the Psychedelic Stealer by exploiting CVE-2025-54517 in the legitimate AMD driver amdhdl64.sys. This campaign utilizes a Bring Your Own Vulnerable Driver (BYOVD) technique to achieve unsigned kernel-mode code execution, allowing attackers to disable EDR sensors within approximately two minutes of infection. Following defense neutralization, the stealer harvests browser credentials, session cookies, and autofill data from Chrome, Edge, and Firefox. Targeting Ukrainian-speaking users via fake CAPTCHA/ClickFix social engineering prompts, the campaign has impacted approximately 12,000 endpoints, resulting in significant credential theft and an estimated $3.2M in financial losses.