Full Report
Cybersecurity researchers are calling attention to a nefarious campaign targeting WordPress sites to make malicious JavaScript injections that are designed to redirect users to sketchy sites. "Site visitors get injected content that was drive-by malware like fake Cloudflare verification," Sucuri researcher Puja Srivastava said in an analysis published last week. The website security company
Analysis Summary
# Tool/Technique: ClickFix Phishing Lure / WordPress Compromise Chain
## Overview
This refers to a multi-stage campaign that exploits vulnerabilities in WordPress websites, primarily through theme modifications, to inject malicious JavaScript. This injected content serves as a remote loader to redirect visitors to phishing pages designed using the **IUAM ClickFix Generator**, mimicking legitimate Cloudflare verification challenges to distribute malware like information stealers.
## Technical Details
- Type: Technique / Campaign Chain (Involves Malware Distribution via Exploited Infrastructure)
- Platform: WordPress Websites (Server-side exploitation); Windows/End-user (Client-side payload execution)
- Capabilities: Remote code execution on web servers, dynamic payload delivery, browser challenge imitation, OS detection, clipboard manipulation, and information stealer distribution.
- First Seen: The related campaign activity was reported in late September/early October 2025.
## MITRE ATT&CK Mapping
*Note: Since this is a complex chain, mappings cover the infection phase and the resulting phishing/payload delivery phase.*
- **TA0001 - Initial Access** (via compromised WordPress site)
- T1190 - Exploit Public-Facing Application (Exploiting theme vulnerabilities)
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell (Implied server manipulation)
- T1027 - Obfuscated Files or Information (Use of Google Ads references to hide code)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (Use of HTTP POST requests for payload retrieval)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Hiding malicious code in `functions.php`)
- **TA0008 - Lateral Movement** (Implied persistence via hidden admin accounts)
- T1078.003 - Valid Accounts: Local Accounts (Creation of unexpected administrator accounts)
## Functionality
### Core Capabilities (WordPress Infection Stage)
- **Injection via Theme File:** Malicious code is inserted into legitimate theme-related files, specifically `functions.php`.
- **Remote Loading:** The injected code acts as a remote loader, initiating an HTTP POST request to a C2 domain (`brazilc[.]com`).
- **Dynamic Payload Retrieval:** The initial C2 responds with dynamic components, including a remote JavaScript file (`porsasystem[.]com/...`) which handles site redirection.
### Advanced Features (Phishing Delivery Stage using IUAM ClickFix Generator)
- **ClickFix Lure:** Creates highly customizable phishing pages that mimic browser verification challenges (e.g., Cloudflare).
- **Evasion Mimicry:** Injects code that mimics legitimate assets like `cdn-cgi/challenge-platform/scripts/jsd/main.js`.
- **OS Detection:** Tailors the infection sequence based on the victim's detected operating system.
- **Clipboard Manipulation:** Possesses capabilities to manipulate the victim’s clipboard, a crucial step for the ClickFix attack sequence.
- **Information Stealer Deployment:** Used to serve malware such as **DeerStealer** and **Odyssey**.
## Indicators of Compromise
- File Hashes: [Not explicitly detailed in the provided text]
- File Names: `functions.php` (Modified file), `6m9x.js`, `js.php` (Scripts hosted remotely)
- Registry Keys: [Not applicable/detailed from the text]
- Network Indicators:
- Initial C2: `brazilc[.]com` (defanged)
- Payload Host/Redirector: `porsasystem[.]com` (defanged) - Associated with Kongtuke/404 TDS.
- Behavioral Indicators:
- HTTP POST request to the initial C2 domain.
- Execution of JavaScript referencing `porsasystem[.]com`.
- Creation of a hidden, 1x1 pixel iframe on the compromised site.
- Redirection to ClickFix-style phishing pages.
## Associated Threat Actors
- Unknown threat actors leveraging WordPress compromise for malware distribution.
- Associated with the **Kongtuke** (aka 404 TDS, Chaya_002, LandUpdate808, TAG-124) Traffic Distribution System linked to `porsasystem[.]com`.
## Detection Methods
- Signature-based detection: Signatures for known malicious JavaScript payloads retrieved from `porsasystem[.]com`.
- Behavioral detection: Monitoring for unexpected outbound HTTP POST requests from web server application processes (like PHP) to external domains, especially when related to known-good files like `functions.php`. Detection of HTML injections that attempt to load external, obfuscated JavaScript.
- YARA rules: Potentially applicable to detect the specific signatures within the injected code blocks used in `functions.php` or the remote JavaScript files.
## Mitigation Strategies
- **Patching/Updates:** Ensure WordPress core, themes (especially the one targeted), and plugins are kept up-to-date.
- **Access Management:** Enforce strong passwords. Scan for and remove any unexpected administrator accounts created for persistence.
- **File Integrity Monitoring (FIM):** Monitor core and theme files (like `functions.php`) for unauthorized modifications.
- **Network Monitoring:** Block outbound connections from the web server environment to known malicious or newly registered domains.
## Related Tools/Techniques
- **IUAM ClickFix Generator:** The tool used to construct the final phishing pages.
- **ClickFix Social Engineering:** The phishing technique being employed to lure victims.
- **Kongtuke / 404 TDS:** The traffic distribution system associated with the payload infrastructure.
- **DeerStealer** and **Odyssey:** Information Stealers deployed via the final phishing landing pages.