Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

ClickFix is a technique, not one actor or malware family. IClickFix and ErrTraffic are framework labels; KongTuke is a source-named cluster. A named compromised website is not proof that every visitor executed malware, and no single CVE explains the ecosystem.

Reporting period

Late 2024 through July 2026

Methodology

Cross-source synthesis of vendor incident observations, campaign research, ATT&CK technique mapping, and official WordPress hardening guidance

Sample scope

Multiple public research clusters; Rapid7 alone identified more than 250 infected sites across at least 12 countries in its observed operation

Claim status

Technique and delivery pattern confirmed; actor attribution and victim impact remain source- and case-specific

1. [1] Rapid7: WordPress compromise and global stealer operationRapid7 Labs
2. [2] Sekoia: IClickFix WordPress-targeting frameworkSekoia.io
3. [3] Trend Micro: KongTuke ClickFix abuseTrend Micro
4. [4] Microsoft: ClickFix technique analysisMicrosoft Security