Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases, deploys ransomware and a lock screen. The campaign turns poorly maintained websites into a large-scale delivery network for data theft and extortion.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a normal WordPress site, then, boom, a full-page message: “Security check: Please complete the CAPTCHA to continue.” But this isn’t a real CAPTCHA. It’s a ClickFix-style trap from a hacked WordPress site, telling you to copy and run a PowerShell command to prove you’re human. If you run it, that PowerShell pulls down malware from a network of nearly 2,000 hacked WordPress sites, stealing files and screenshots, and in some cases triggering ransomware and a lock screen. Remember this: a CAPTCHA that asks you to copy, paste, or run any command, especially PowerShell, is fake. Close the tab immediately and walk away from that site.
Researchers found a criminal operation (StopAndProtect) that used nearly 2,000 hacked WordPress sites as a delivery network. Visitors were shown a fake CAPTCHA that pressured them to copy and run a PowerShell command, which then installed malware that could steal data, capture screenshots, and…
Researchers observed real-world infections where compromised WordPress sites showed a fake “Cloudflare Turnstile” verification and instructed visitors to press Win+R and run a PowerShell command. The attacker’s page guides victims step-by-step (and reports progress back to the operator) to execute…
Researchers uncovered a large campaign called StopAndProtect that uses hacked WordPress sites to show visitors a fake CAPTCHA and trick them into running a PowerShell command. That one action kicks off a multi-stage infection that can encrypt files (ransomware), steal documents, passwords/wallet…
Multiple real-world intrusions used a ClickFix-style lure where victims visiting compromised websites saw fake CAPTCHA prompts and were tricked into running a command themselves. Separately, attackers also abused the legitimate, signed Node.js runtime (node.exe) to run malicious JavaScript while…
A CTM360 report describes real-world “ClickFix” campaigns where attackers compromise legitimate websites and show fake error/verification messages that trick users into copying a command and pasting it into trusted system tools (Run box, PowerShell, Terminal). This approach avoids traditional…
A state-sponsored campaign in South Korea used spear-phishing and hacked “trusted” local websites to infect visitors who had vulnerable AnySign4PC installed. In some cases, simply visiting a compromised page triggered the exploit and installed SIGNBT or COPPERHEDGE backdoors without any download…
