Malicious WordPress Sites Spread Stealer Malware Globally

What Happened

Imagine visiting a trusted website, only to find it has been hijacked by hackers. This is exactly what's happening with over 250 legitimate WordPress sites that have been compromised to spread malware. Rapid7 Labs uncovered a campaign where an unidentified threat actor is injecting a fake Cloudflare human verification challenge, known as ClickFix, to trick users into downloading malware. Once infected, the malware can steal sensitive information like passwords and digital wallet details from Windows systems.

Additionally, more than 30 plugins from the EssentialPlugin package have been compromised, allowing unauthorized access to thousands of WordPress sites. This backdoor, which has been present since August 2025, was recently activated to inject malware into websites, further exacerbating the risk to users.

This malware campaign has been active since December 2025, but its infrastructure dates back even further. The infected sites span at least 12 countries, including the US, UK, Germany, and India. Some of these sites are even regional news outlets or official pages of political candidates. This makes the threat particularly dangerous because users are more likely to trust these sites, thinking they are safe to visit.

Why Should You Care

You might think that only shady websites pose a risk, but this incident shows that even trusted sites can be compromised. If you visit one of these infected sites, you could unknowingly download malware that steals your credentials. Think of it like getting a virus from a seemingly healthy apple; it looks good on the outside, but inside, it’s rotten.

This is not just a problem for individuals; organizations can also be targeted. If hackers steal your company's credentials, they could access sensitive data or conduct financial theft. Staying vigilant online is crucial, especially when browsing sites that seem trustworthy. Always question the legitimacy of what you see online.

What's Being Done

Rapid7 is actively monitoring this situation and has published a detailed analysis of the malware infection chain. They have also released a list of Indicators of Compromise (IoCs) and detection rules to help organizations defend against this threat. WordPress.org has responded to the plugin compromise by closing the affected plugins and pushing a forced update to neutralize the backdoor’s communication. However, they cautioned that this action did not clean core configuration files, which could still harbor the malware.

Here are some immediate actions to consider:

• Check if your website is on the list of compromised sites.
• Update your security measures to detect and block this malware.
• Educate your team about the risks of visiting seemingly safe websites.

Experts are keeping an eye on how this campaign evolves and whether more websites will be targeted. The key takeaway is to stay informed and proactive about your online safety.