Minacce e avversari · Furto di credenziali
Attori criminali hanno compromesso oltre 250 siti WordPress e iniettato falsi CAPTCHA 'ClickFix' che inducono i visitatori a eseguire comandi per consegnare un infostealer Windows.
3 fonti · 16 mar
CSO Online
ClickFix techniques evolve in new infostealer campaigns
Recent social engineering schemes involving WordPress and Microsoft’s Windows Terminal show that this relatively basic tactic is a growing threat.
originaleInfosecurity Magazine
Compromised WordPress Sites Deliver ClickFix Attacks
Over 250 legitimate websites, including news outlets and a US Senate candidate’s official webpage, been compromised to infect visitors with infostealers, warn Rapid7 researchers
originaleRapid7
When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation
Rapid7 Labs has identified an ongoing, widespread compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant (impersonating a Cloudflare human verification challenge [CAPTCHA]).
originalePart of the PlainSec briefing for 2026-03-16
Every edition of this story: Criminali Sfruttano 250+ Siti WordPress per Rubare Credenziali