ClickFix Malware Campaign: Decentralized Payload Hosting via WordPress Exploitation

A widespread cyberattack campaign has compromised over 5,400 WordPress websites to distribute multi-stage malware using the "ClickFix" social engineering technique. Attackers leverage critical RCE vulnerabilities in plugins—including CVE-2026-14894 (Super Forms) and CVE-2026-32475 (Elementor Pro)—to inject scripts that display deceptive Cloudflare CAPTCHAs or browser error prompts. These lures trick users into manually executing malicious PowerShell or Terminal commands. To ensure resilience, the campaign utilizes "EtherHiding," hosting payloads and C2 resolution on the Polygon and BNB Smart Chain blockchains. Impacted systems are infected with diverse payloads, including DeepLoad, KongTuke (ModeloRAT), and ACR Stealer, targeting both Windows and macOS environments for enterprise credential theft and network intrusion.

• Attack Vector: WordPress Exploitation and User-Initiated Execution

  • Exploits critical RCE flaws in WordPress plugins (e.g., Super Forms and Elementor Pro) to inject malicious JavaScript into legitimate site overlays.
  • Employs "ClickFix" lures, such as fake CAPTCHA checks or "CrashFix" prompts that intentionally crash browsers to coerce users into "fixing" the issue.
  • Hijacks the system clipboard to provide a malicious command, tricking users into pasting and executing it via Windows Run or macOS Terminal.
  • Bypasses traditional exploit kits by relying on user-assisted execution of Living-off-the-Land Binaries (LOLBins) like mshta.exe and powershell.exe.

• Infrastructure: Blockchain-Based Payload and C2 Hosting

  • Utilizes "EtherHiding" to store malicious payloads and C2 pointers on the Polygon and BNB Smart Chain (BSC) immutable ledgers.
  • Implements decentralized dead-drop resolvers, allowing attackers to dynamically update C2 server addresses for fractions of a cent, bypassing domain-based blacklisting.
  • Leverages the Deno JavaScript runtime as a core execution mechanism in recent chains to facilitate remote payload retrieval and persistence.
  • Employs a Malware-as-a-Service (MaaS) model, selling complete ClickFix kits with pre-built lure templates on underground forums.

• Malware Families and Technical Payloads

  • DeepLoad: Uses AI-generated code to create massive layers of obfuscation (meaningless variable assignments) to evade static file scanning.
  • KongTuke: Deploys ModeloRAT for domain-aware reconnaissance and persistent access, specifically targeting domain-joined corporate hosts.
  • ACR Stealer: Focuses on enterprise data theft, utilizing WebDAV-delivered payloads and steganography to hide data within PNG images.
  • TerminalFix: Establishes multiplexed reverse TCP tunnels via DLL sideloading and encrypted WebSocket traffic to create remote access doorways.

• Advanced Evasion and Threat Actor Adoption

  • Integrates AI-assisted obfuscation to bypass EDR signature detection and generates temporary DLLs in memory via the Add-Type C# compilation feature.
  • Adopts steganographic delivery, where shellcode is reconstructed from pixel data in seemingly benign PNG images.
  • Observed adoption by nation-state actors, including Russia's Sandworm (GRU), APT28, and North Korea's Kimsuky, for espionage and targeted network compromise.
  • Implements server-side filtering, including IP blacklisting and geographic gating, to evade security researchers and automated sandboxes.

• Defensive Actions and Mitigation Strategies

  • Audit WordPress environments for unauthorized JavaScript injections and ensure plugins (Super Forms, Elementor Pro) are updated to patched versions.
  • Monitor for anomalous outbound traffic to public blockchain RPC services and decentralized storage gateways used for C2 resolution.
  • Implement behavioral detection for suspicious mshta.exe or powershell.exe execution patterns immediately following browser-based user interactions.
  • Restrict the use of winget.exe and other package managers to prevent the unauthorized installation of runtimes like Deno in enterprise environments.