WHEN TRUSTED WEBSITES TURN MALICIOUS: WORDPRESS COMPROMISES ADVANCE GLOBAL STEALER OPERATION

Summary from the TLDR InfoSec newsletter

Rapid7 Labs identified an active campaign compromising over 250 legitimate WordPress sites across 12 countries, injecting a fake Cloudflare CAPTCHA ClickFix lure that tricks Windows users into pasting a PowerShell command that downloads the DoubleDonut shellcode loader, ultimately delivering Vidar Stealer v2, a newly identified .NET stealer dubbed Impure Stealer, and a new campaign-specific C++ stealer named VodkaStealer. The attack chain runs almost entirely in memory, injecting payloads into svchost.exe via VirtualAllocEx and CreateRemoteThread to evade file-based detection, while the ClickFix JavaScript actively filters out WordPress admin cookies, known bot user agents, and wp-admin referrers to avoid tipping off site owners. WordPress administrators should restrict public access to wp-admin, enforce MFA, audit plugins for known-vulnerable versions, and review Rapid7's published YARA rules and IOCs to detect this campaign.