Threats & Adversaries · Credential Theft

Over 250 WordPress sites serve ClickFix CAPTCHA infostealers

The ClickFix prompt tricks users into pasting a Windows Run command that launches in-memory infostealers. Observed payloads (Vidar, Impure, Vodka, Double Donut) steal credentials and crypto wallets.

3 sources · Mar 16

Timeline

• Mar 16 Reported by CSO Online
• Mar 11 Reported by Infosecurity Magazine
• Mar 10 Reported by Rapid7

Sources

• Mar 16 CSO Online

  ClickFix techniques evolve in new infostealer campaigns

  Recent social engineering schemes involving WordPress and Microsoft’s Windows Terminal show that this relatively basic tactic is a growing threat.

  original

• Mar 11 Infosecurity Magazine

  Compromised WordPress Sites Deliver ClickFix Attacks

  Over 250 legitimate websites, including news outlets and a US Senate candidate’s official webpage, been compromised to infect visitors with infostealers, warn Rapid7 researchers

  original

• Mar 10 Rapid7

  When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation

  Rapid7 Labs has identified an ongoing, widespread compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant (impersonating a Cloudflare human verification challenge [CAPTCHA]).

  original

Part of the PlainSec briefing for 2026-03-12

Every edition of this story: Over 250 WordPress sites serve ClickFix CAPTCHA infostealers

More from today

• Iran-linked hackers cripple Stryker's global Microsoft environment
• Iran-aligned actors escalate cyber attacks on US, allies
• Fake developer interviews deliver backdoors, steal credentials