Malware - ClickFix Infostealer Campaigns Target WordPress

What Happened

Cybercriminals are evolving their tactics with ClickFix campaigns, targeting WordPress websites to distribute new infostealer malware. In a recent operation, over 250 websites across 12 countries were compromised. These attacks utilize sophisticated social engineering methods, making them a significant threat to website owners and visitors alike.

The ClickFix campaigns have been active since December 2025, employing deceptive techniques like fake Cloudflare CAPTCHA prompts to trick users. This method allows attackers to execute malicious code while remaining undetected by website administrators. As the attacks grow in sophistication, they pose a serious risk to the integrity of online platforms.

Who's Being Targeted

The victims of ClickFix campaigns include a diverse range of WordPress sites, from local business pages to regional news portals and even political candidates. The widespread nature of these attacks indicates a high level of automation and organization among the attackers. This suggests that they are not just targeting random sites but are likely engaging in long-term criminal operations.

The compromised websites often lack basic security measures, making them easy targets for exploitation. As these campaigns continue to evolve, the potential for damage increases, affecting both website owners and their visitors.

Signs of Infection

Indicators of infection include unusual behavior on compromised websites, such as unexpected CAPTCHA prompts and requests for commands to be entered into the Windows Run dialog. The ClickFix campaigns deploy multiple infostealer payloads, including a new variant of the Vidar Stealer, which uses advanced techniques to evade detection.

The malware operates primarily in memory, injecting malicious code into legitimate Windows processes. This stealthy approach makes traditional file-based detection methods ineffective, complicating the identification of infected systems.

How to Protect Yourself

Website administrators should take immediate action to secure their WordPress sites. This includes restricting access to admin login areas and ensuring that strong, unique passwords are used. Regularly updating plugins and themes is essential to mitigate vulnerabilities that attackers may exploit.

Security experts recommend monitoring for signs of compromise and utilizing tools like YARA rules for detection. By implementing these measures, website owners can better protect themselves against the growing threat of ClickFix and similar campaigns.