Full Report
Rapid7 says crims compromised more than 250 sites globally, including a US Senate candidate’s campaign page Cyber baddies quietly compromised legitimate WordPress websites, including the campaign site of a US Senate candidate, turning them into launchpads for a global infostealer operation.…
Analysis Summary
# Tool/Technique: Fake CAPTCHA Infostealer Delivery (ClickFix)
## Overview
This technique involves the compromise of legitimate WordPress websites to deliver information-stealing malware. Attackers inject malicious code into these sites to display a fraudulent Cloudflare CAPTCHA or "Verify You Are Human" prompt. Instead of a standard interaction, users are socially engineered into executing a PowerShell command on their local machine, which initiates the malware infection chain.
## Technical Details
- **Type**: Social Engineering / Malware Delivery Technique (ClickFix variant)
- **Platform**: Multi-platform (Social engineering targets Windows/PowerShell users)
- **Capabilities**: Website injection, credential harvesting, browser data theft, cookie session hijacking.
- **First Seen**: Current campaign active since December 2025 (infrastructure dating back to July 2024).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555.003 - Credentials from Web Browsers]
## Functionality
### Core Capabilities
- **Social Engineering**: Mimics legitimate Cloudflare verification pages to lower victim suspicion.
- **Automated WordPress Compromise**: High-scale injection across 250+ unrelated sites suggests the use of automated vulnerability scanners/exploiters.
- **Command Execution**: Instructs users to copy a malicious command (often `CTRL+V` into a Run prompt or PowerShell window).
### Advanced Features
- **Reputation Hijacking**: Leverages the SSL certificates and domain reputation of legitimate sites (e.g., government campaign sites, media outlets) to bypass web filters.
- **Credential Stealing**: Deployment of infostealers to extract browser-stored passwords, authentication cookies, and cryptocurrency wallets.
## Indicators of Compromise
- **File Hashes**: (Specific hashes not provided in the article; researchers refer to generic Windows infostealer variants).
- **File Names**: `PowerShell.exe` (Abused process).
- **Network Indicators**:
- `cloudflare-verify[.]com` (Example of typical defanged infrastructure)
- `verify-user[.]top` (Example of typical defanged infrastructure)
- *Note: Rapid7 indicates infrastructure registrations began in July/August 2024.*
- **Behavioral Indicators**:
- Sudden appearance of a "Human Verification" overlay on a site that does not usually require one.
- Instructions asking the user to use "Paste" (CTRL+V) and "Enter" within a system terminal.
## Associated Threat Actors
- **ClickFix Campaign Operators**: An organized criminal effort specializing in "Technical Support" style lures applied to web browsing.
## Detection Methods
- **Signature-based detection**: Web security gateways scanning for injected JavaScript patterns associated with "ClickFix" or fake CAPTCHA overlays.
- **Behavioral detection**:
- Monitoring for PowerShell processes initiated with suspicious encoded commands.
- Identifying `CURL` or `WGET` requests originating from the command line directed at unknown external ZIP or EXE resources.
- **YARA rules**: Rules targeting the specific HTML/JavaScript structures of the fake Cloudflare overlay.
## Mitigation Strategies
- **Prevention measures**:
- Use of script-blocking browser extensions.
- User awareness training: Instructing users that legitimate CAPTCHAs never require running commands or copying scripts to the clipboard.
- **Hardening recommendations**:
- **For Website Owners**: Keep WordPress core, plugins, and themes updated; implement Web Application Firewalls (WAF).
- **For End Users**: Restrict PowerShell execution policies to "AllSigned" or "Restricted" via Group Policy.
## Related Tools/Techniques
- **ClickFix**: The broader technique of using fake error messages (e.g., "Google Chrome Update" or "Word Document fix") to trick users into running scripts.
- **LUMMA/RedLine/StealC**: Common infostealer families often deployed via this specific delivery method.