IntelliOSPANDAModule|AIFlash Threat Intel BriefClickFix
Campaign Impacting WordPress
WordPressSocial engineeringInfostealers
Published
23-Jun-2026
Brief Version
v1.7
Updated
0x via AI Monitoring Agents
Next AI Monitor
Daily at 1:00 PM ET for 12 months
Brief ID
PANDA-FTIB-CLICKFIX-WORDPRESS-2026-001
Template
Flash Threat Brief Template v2.0
Research Framing
| Field | Value | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| User Topic | ClickFix Campaign Impacting WordPress | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Interpreted Questions | Is ClickFix-on-WordPress now a repeatable delivery ecosystem? Which frameworks and clusters are source-supported? How does the attack work, who is exposed, what should defenders hunt, and how should WordPress and endpoint teams respond? | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Initial Observations | Independent research supports a recurring pattern: legitimate WordPress sites are compromised, fake verification content is selectively served, and Windows visitors are instructed to run a command that can deliver stealers or remote-access tooling. Rapid7 identified more than 250 infected sites across at least 12 countries in its observed operation, but that number is not a universal ClickFix victim count. 1,2,3,4 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Evidence Boundary | ClickFix is a technique, WordPress is a delivery platform, and IClickFix, ErrTraffic, KongTuke, and the Rapid7 operation are source-specific labels. This brief does not infer one operator, one root-cause CVE, or endpoint compromise for every named website visitor. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Source Coverage |
|
ClickFix Campaign Snapshot
Technique
ClickFix
Fake verification prompt instructs a user to copy, paste, and run an attacker-supplied command.
Delivery
WordPress
Compromised legitimate sites serve lures through injected code, redirects, or backdoored components.
Frameworks
3+
IClickFix, ErrTraffic v3 / GlitchFix, KongTuke, and adjacent ClickFix delivery variants.
AI Monitor
Active
Daily PANDA AI Agent update monitors material campaign, remediation, payload, attribution, and public-impact changes.
1-Topic
This brief covers the ClickFix Campaign Impacting WordPress, in which compromised WordPress sites are used as delivery infrastructure. The core pattern is a legitimate-looking site or verification page that instructs the visitor to copy and run a command, turning social engineering into endpoint execution.1,2,4,5,6,9
| Focus | Source-Backed Answer |
|---|---|
| What is happening? | Attackers are abusing trusted websites and fake CAPTCHA or verification flows to coax users into manually running malicious commands. |
| Why WordPress? | WordPress estates are common, extensible, and often plugin-heavy, so compromised sites can become scalable delivery points even when the endpoint victim is a visitor. |
| Analytical boundary | ClickFix is the execution technique, compromised WordPress is a delivery vector, and IClickFix, ErrTraffic v3, and KongTuke are framework or cluster labels that should not be collapsed into one actor. |
2-Persona / Audience Lens
This brief is written for CISOs, SOC/IR teams, WordPress and hosting administrators, detection engineers, MDR teams, MSPs, cyber insurance scopers, breach counsel, and client-facing advisors. It focuses on the practical distinction that matters during triage: ClickFix is the social-engineering technique, compromised WordPress sites are a dominant delivery vector, and IClickFix, ErrTraffic v3, and KongTuke are examples of named frameworks or clusters using that model.
3-BLUF
- Why leaders should care now: a user can begin on a legitimate, trusted website and end with credential-stealing malware after following a fake verification prompt. That makes reputation, endpoint compromise, identity exposure, and downstream account misuse one connected incident. 1,3,5
- ClickFix is the technique, not the actor: the victim is persuaded to copy and run an attacker-supplied command, often after seeing a fake CAPTCHA, fake Cloudflare check, or browser/system prompt. 5,6,9
- WordPress is recurring delivery infrastructure: attackers compromise legitimate sites, inject malicious JavaScript or server-side persistence, and selectively show ClickFix content to visitors. 1,2,3,4
- Do not collapse distinct operations: IClickFix and ErrTraffic are framework labels, KongTuke is a source-named cluster, and Rapid7's observed stealer operation was unattributed. Similar lures do not prove a single operator. 1,2,3,4,13,14,15
- The website and endpoint are different victims: the WordPress property is the delivery point; a visitor endpoint becomes compromised only if the malicious chain executes. A named infected site is not proof that every visitor was infected. 1,2,3
- Execution can create a credential incident: reported payload goals include infostealers, browser-session theft, wallet theft, loaders, and remote access. If the command ran, isolate the endpoint and rotate credentials and sessions reachable from it. 1,2,3,4,5
- There is no universal ClickFix CVE: each compromised site requires its own root-cause analysis for vulnerable plugins or themes, stolen administrator credentials, hosting access, injected code, or backdoors. 1,4,10,17,18
- Response must run on two tracks: preserve and eradicate the WordPress compromise while separately hunting any endpoint where a user ran the command. Cleaning only the site or only the workstation leaves the other side unscoped. 1,4,9,10,17,18
- What the current monitoring baseline means: IntelliOS has raised this from a static technique explainer to a monitored campaign product because multiple independent sources support a repeatable WordPress delivery pattern. The practical change is to prepare a joint web-and-endpoint playbook before a case arrives, while keeping attribution and victim counts source-bounded. 1,2,3,4
4-Executive Summary
ClickFix is no longer best understood as a strange one-off lure where a victim happens to paste a command. The technique has matured into a repeatable social-engineering pattern: the victim sees a fake CAPTCHA, fake Cloudflare verification check, or similar prompt, then is instructed to open a Windows Run dialog, terminal, or command shell, paste a command, and execute it. Microsoft and MITRE now frame this as malicious copy-and-paste user execution, which gives defenders a cleaner way to describe, hunt, and report it.5,6,9
The WordPress connection is the key operational shift. Rapid7 documented legitimate WordPress sites compromised to load ClickFix content that impersonated Cloudflare human verification. Sekoia identified IClickFix as a WordPress-targeting framework, LevelBlue described ErrTraffic v3 using compromised WordPress sites and PHP must-use plugin backdoors, and Trend Micro reported KongTuke activity abusing compromised WordPress sites with fake CAPTCHA lures. Together, those sources support describing this as a WordPress-based ClickFix delivery ecosystem, not just a ClickFix attack that happened to use WordPress.1,2,3,4
The threat is two-sided. For website owners, the risk is that a trusted WordPress property becomes malware delivery infrastructure through injected JavaScript, backdoored plugins, unauthorized admin access, or malicious redirects. For visitors, the risk is endpoint compromise after they follow fake verification instructions and run attacker-supplied commands. That second step can lead to infostealers, RATs, credential theft, wallet theft, remote access, and follow-on intrusion activity.
ClickFix should not be described as one JavaScript, Python, or PHP tool. It is a technique and delivery pattern. In the WordPress cases retained here, the web-side compromise often involves JavaScript or HTML injection plus PHP persistence such as backdoored plugins or must-use plugins. The endpoint-side execution often involves PowerShell, script interpreters, command retrieval, downloader behavior, and payloads such as stealers or RATs. That distinction helps scopers avoid asking the wrong question: the right question is not "what language is ClickFix written in?" but "where did the WordPress injection live, what command did the user execute, and what payload or remote-control capability followed?"1,4,5,7,9,12
Open-source reporting does show the kinds of commands victims are pushed toward, but those artifacts should be handled as evidence, not copied into a live shell. Defensive examples should be kept non-runnable: browser-delivered PowerShell downloaders, script-host retrieval, and finger-style command retrieval patterns have all appeared in public ClickFix reporting. Preserve the exact command line, clipboard content, browser history, and EDR process chain from affected endpoints, then defang URLs and tokens before sharing them.1,5,7,9,12
| Observed Pattern | Safe Non-Runnable Example | IR / Legal Scoping Value |
|---|---|---|
| PowerShell downloader | `powershell <flags> <download-or-decode-stage>` with all domains, tokens, and payload paths defanged. | Shows browser-to-shell execution and possible payload retrieval; preserve command line, script-block logs, and downloaded artifacts. |
| Finger-style retrieval | `finger <token>@<redacted-host> | <shell>` as a sanitized pattern only, not an executable command. | Useful when the visible command retrieves a second-stage instruction set from attacker infrastructure. |
| Loader / RAT / stealer follow-on | Endpoint executes a retrieved script, loader, MSI, or binary that can install stealers or remote access tooling. | Escalates the incident from user exposure to possible endpoint control, credential theft, cloud-session theft, and reportable data access. |
Response should therefore split into two workstreams. Web teams need to preserve evidence, inspect WordPress files and plugins, remove unauthorized code and users, rotate credentials, and harden the CMS. SOC and endpoint teams need to hunt browser-to-shell execution, PowerShell and script interpreter activity, payload downloads, suspicious credential access, and post-execution persistence. A site cleanup alone does not scope visitors who ran the command; an endpoint cleanup alone does not remediate the compromised delivery infrastructure.10,17,18
Expansion Research Add
The strongest analytical value is the taxonomy: ClickFix is the technique, WordPress compromise is the delivery vector, and IClickFix / ErrTraffic v3 / KongTuke are named frameworks or clusters. Keeping those layers separate prevents over-attribution and gives scopers the right questions for both web and endpoint evidence.5-AI Agent Delta Updates
| Field | Value |
|---|---|
| Initial Publish Date | 23-JUN-2026 |
| AI Monitoring Agent Runs | 0 completed recurring production runs; the source-backed baseline and monitoring configuration are active. |
| Next Scheduled AI Monitor | Daily at 1:00 PM ET for 12 months |
| Current Material Delta | The brief now treats the activity as a monitored, source-bounded campaign pattern; adds a canonical CARDS campaign record; strengthens decision-ready BLUF, framing, source weighting, and response boundaries; and enables subscriber Page Alerts. |
| What It Means | Independent sources support preparing a repeatable two-track response for compromised WordPress infrastructure and user-executed endpoint malware. They do not support attributing all ClickFix activity to one actor or counting every infected website as an endpoint victim. |
6-Why It Matters
ClickFix succeeds because it turns the user into the execution step while borrowing trust from familiar verification patterns. When the lure is served through a compromised WordPress site, the victim may start on a legitimate domain, which lowers suspicion before the fake Cloudflare or CAPTCHA page asks them to run a command. This is why the campaign family matters for both website owners and endpoint defenders.
Technique
ClickFix
Fake verification prompt instructs the user to copy and run a malicious command.
Delivery Vector
WordPress
Compromised sites inject JavaScript, iframes, backdoors, or redirectors to present the lure.
Objective
Steal / Access
Common goals include infostealers, credentials, wallets, RATs, and follow-on intrusion paths.
| Audience | Why This Changes the Conversation | Immediate Scoping Question |
|---|---|---|
| Executive / Client | A trusted public website can become the beginning of an identity and endpoint compromise without the visitor downloading an obvious file. | Did any employee follow the prompt, and what credentials or business systems were reachable from that device? |
| Counsel / Privacy | Website compromise, endpoint execution, and confirmed data access are separate facts with different notification and evidence implications. | What is confirmed for the site, the endpoint, the accounts, and any accessed data—and what remains inference? |
| Web / Hosting | Removing the visible lure does not prove the server, database, administrator accounts, or hosting plane are clean. | Can we establish root cause and integrity, or is a clean rebuild the safer recovery path? |
| SOC / IR | The decisive telemetry is the transition from browser activity to a user-run command and its post-execution behavior. | Which endpoints show browser-to-shell activity, payload retrieval, credential access, persistence, or outbound control traffic? |
7-Timeline
| Date / Period | Event | Source-Backed Meaning | Source |
|---|---|---|---|
| Early 2024 | Microsoft says ClickFix-style campaigns were already being observed across customers and payload families. | The technique predates the recent WordPress-focused wave. | 5 |
| Late 2024 | Sekoia reports IClickFix activity involving compromised WordPress sites and fake Cloudflare-style lures. | WordPress compromise became a recognizable delivery pattern for ClickFix. | 2 |
| January 2025 | Red Canary notes KongTuke activity using fake CAPTCHA / ClickFix-style paste-and-run lures. | A named threat cluster moved into ClickFix variants. | 14 |
| December 2025 | SANS ISC documents ClickFix variants using command retrieval behavior such as finger.exe. | ClickFix command staging evolved beyond one simple PowerShell string. | 12 |
| March 2026 | Rapid7 and Trend Micro publish WordPress/ClickFix research involving compromised legitimate sites and KongTuke activity. | The WordPress delivery vector and fake verification model were well documented by multiple vendors. | 1,3 |
| April 2026 | LevelBlue publishes ErrTraffic v3 ClickFix research involving compromised WordPress sites and EtherHiding. | Framework-level WordPress ClickFix delivery continues to evolve. | 4 |
| June 2026 | Sekoia publishes additional ErrTraffic research and expansion context. | The framework ecosystem remains active and worth monitoring. | 15 |
8-Incident Response Playbook Ideas
| Phase | Playbook Idea | Likely Owner |
|---|---|---|
| Preserve | Preserve the affected URL, page source, network captures, WordPress files, server logs, EDR telemetry, and browser history before cleanup. | SOC / Web Admin |
| Website containment | Take the compromised WordPress site or affected route out of rotation, rotate admin/API credentials, remove unauthorized users, and snapshot files/databases. | Web / Hosting |
| WordPress eradication | Patch WordPress core, plugins, and themes; remove unknown plugins/mu-plugins; validate file integrity; review admin-ajax handlers and theme templates. | Web / AppSec |
| Cleanup validation | Do not treat a scanner button as guaranteed eradication. Use malware scanners and security plugins as triage aids, then verify files, database content, users, cron jobs, redirects, and hosting credentials manually. | Web / AppSec |
| Rebuild decision | If root cause, persistence, or integrity cannot be proven, rebuild from clean WordPress core, trusted plugin/theme packages, known-good content, and rotated credentials rather than trusting targeted cleanup. | Web / Hosting / Counsel |
| Endpoint containment | For users who followed ClickFix instructions, isolate endpoints, collect command history and clipboard artifacts, revoke potentially stolen credentials/tokens, and run stealer/RAT response playbooks. | IR / Helpdesk |
| Blast-radius scoping | If a RAT or loader executed, assume possible remote control: review interactive logons, persistence, browser credential access, wallet access, cloud sessions, email rules, VPN/RMM credentials, and lateral movement opportunities. | IR / Legal / Claims |
| Detection | Deploy endpoint detections for browser-to-shell execution and web detections for fake CAPTCHA/Cloudflare injection patterns. | Detection Engineering |
WordPress Locations To Inspect
| Location / Artifact | Why It Matters | Cleanup / Validation Action |
|---|---|---|
| `wp-content/plugins/` and `wp-content/mu-plugins/` | Malicious or backdoored plugins, including must-use plugins, can load code persistently before normal plugins. | Compare to trusted packages, remove unknown plugins, review timestamps, and reinstall clean copies. |
| `wp-content/themes/<theme>/`, `functions.php`, and template files | Themes are common injection points for JavaScript, redirects, fake verification pages, and loader snippets. | Diff against known-good theme versions and remove injected code rather than editing blindly. |
| `wp-content/uploads/` | Writable upload directories are sometimes abused to store PHP files, staged payloads, or hidden scripts. | Search for executable files, unexpected PHP, recently modified assets, and suspicious web access. |
| WordPress core directories and `.htaccess` | Core-file modification or redirect rules can hide persistence or route visitors to ClickFix pages. | Reinstall clean WordPress core and review `.htaccess`, cron, redirects, and hosting control-panel changes. |
| Database options, posts, widgets, users, and admin accounts | Injected scripts and unauthorized admin access can live in the database rather than on disk. | Inspect site URL/home options, widgets, posts, plugin options, admin users, and recently changed records. |
Expansion Research Add
There is no universal public auto-removal tool for ClickFix-on-WordPress because the compromise can live in files, database records, plugins, themes, hosting configuration, or endpoint payloads. Security plugins and scanners can help with triage, but high-confidence eradication requires comparing against known-good state, rotating credentials, removing persistence, and rebuilding when integrity cannot be proven.10,17,189-Term Glossary
| Term | Meaning | Source |
|---|---|---|
| ClickFix | A social-engineering technique that instructs a user to copy, paste, and run a malicious command under the pretext of fixing verification, browser, CAPTCHA, or system issues. | 5,6,9 |
| Compromised WordPress delivery | Use of a legitimate but compromised WordPress site to inject malicious JavaScript, redirect visitors, or display ClickFix lures. | 1,2,4 |
| IClickFix | A WordPress-targeting framework reported by Sekoia that uses compromised WordPress sites and ClickFix-style lures. | 2 |
| ErrTraffic v3 | A malware distribution framework reported using ClickFix mode, WordPress backdoors, obfuscated JavaScript, and EtherHiding-style retrieval. | 4,13,15 |
| KongTuke | A named cluster that has used fake CAPTCHA / ClickFix variants and compromised WordPress delivery paths. | 3,14 |
| Injected JavaScript / HTML | Web-side code inserted into pages, templates, plugin output, database content, or external script tags to show a fake verification prompt, redirect users, or load the next stage. | 1,2,4,17,18 |
| PHP backdoor / mu-plugin | Server-side WordPress persistence that can live in plugins, must-use plugins, themes, uploads, or other writable paths and continue serving malicious logic after superficial cleanup. | 4,17,18 |
| Remote Access Trojan (RAT) | Malware or tooling that can provide interactive remote control of a victim endpoint after execution. In ClickFix incidents, RAT risk means the response should look beyond one pasted command and scope hands-on-keyboard activity, persistence, and credential access. | 1,2,3,4,5 |
| Infostealer | Malware designed to collect browser passwords, cookies, wallets, tokens, files, or other sensitive artifacts. ClickFix execution often creates a stealer-risk event even when the original delivery point was only a compromised website. | 1,3,4,5 |
| Clean rebuild | A higher-assurance recovery path where WordPress core, themes, plugins, and hosting configuration are redeployed from trusted sources and only audited content/data is restored. Use when root cause, persistence, or integrity cannot be proven. | 10,17,18 |
10-TTPs
| Source-Backed TTP | MITRE ATT&CK Mapping | Defensive Focus | Sources |
|---|---|---|---|
| Compromise legitimate WordPress sites and inject malicious JavaScript | T1189: Drive-by Compromise | Inspect WordPress templates, plugins, mu-plugins, admin-ajax routes, unexpected script tags, and external script loads. | 1,4,8,10 |
| Show fake CAPTCHA / Cloudflare / system prompts that instruct copy-paste execution | T1204.004: Malicious Copy and Paste | Alert on clipboard-driven command execution and user-run commands spawned from browsers. | 5,6,9 |
| Execute PowerShell or shell commands that retrieve next-stage payloads | T1059.001: PowerShell | Monitor PowerShell encoded commands, hidden windows, download cradles, suspicious child processes, and script-block logging. | 1,4,7,9,12 |
| Deliver infostealers, RATs, loaders, or wallet/credential theft payloads | T1105: Ingress Tool Transfer | Correlate browser execution, network downloads, new persistence, credential-store access, and suspicious outbound connections. | 1,2,3,4 |
11-CVE / Vulnerability References
This brief does not center on a single CVE. The recurring risk is exploitation or abuse of WordPress exposure, weak administrator access, vulnerable plugins/themes, unauthorized JavaScript injection, and backdoored WordPress components. When a specific affected site is identified, defenders should separately determine whether a known plugin/theme/core CVE, stolen credential, hosting-panel compromise, or webshell enabled the injection. WordPress hardening guidance remains relevant even where no single root-cause CVE is proven. 10
| Root-Cause Question | Evidence to Collect | Decision Meaning |
|---|---|---|
| Was a known core, plugin, or theme vulnerability exploited? | Exact component versions, patch history, web logs, exploit traces, vendor advisories, and current KEV/CVE status. | If supported, patch every exposed instance and hunt for exploitation before the fix date; do not assume the CVE explains persistence or visitor impact. |
| Were valid administrator or hosting credentials used? | Login history, MFA events, new users, password resets, hosting-panel and SFTP/SSH activity. | Rotate site, hosting, database, API, deployment, and reused credentials; review whether access reached other hosted properties. |
| Can site integrity be proven? | Known-good file/package comparison, database review, admin accounts, scheduled tasks, redirects, mu-plugins, uploads, and hosting configuration. | If root cause or persistence remains uncertain, rebuild from clean components rather than trusting a cosmetic cleanup. |
12-IOCs / Observables
This page does not publish a stable universal blocklist. ClickFix campaigns rotate domains, payloads, commands, and delivery scripts. Use the observables below as scoping prompts and validate live IOCs against current vendor feeds and local telemetry.
| Observable Type | What To Hunt / Collect | How To Use It | Source |
|---|---|---|---|
| WordPress observable | Unexpected external JavaScript, injected iframe logic, fake performance-optimizer code, suspicious admin-ajax actions, or mu-plugin backdoors. | Diff themes/plugins, inspect wp-content and mu-plugins, review admin users, and search for unfamiliar external script domains. | 1,4,10 |
| WordPress persistence locations | `wp-content/plugins/`, `wp-content/mu-plugins/`, `wp-content/themes/<theme>/`, theme `functions.php`, template files, `uploads/` PHP files, modified `.htaccess`, suspicious core-file changes, database options/posts/widgets, and unauthorized admin users. | Compare against known-good WordPress core, plugin, and theme packages; inspect the database for injected script; and treat mu-plugins/uploads PHP as high-signal persistence locations. | 4,10,17,18 |
| Language / code family | ClickFix is a technique, not a single language. WordPress delivery commonly uses injected JavaScript/HTML and PHP backdoors; endpoint execution commonly uses PowerShell, script hosts, downloader commands, or retrieved scripts. | Separate CMS evidence from endpoint evidence: web files/database for JavaScript/PHP injection, and endpoint telemetry for PowerShell, mshta, curl, finger, script interpreters, MSI/downloaders, or RAT/stealer payloads. | 1,4,5,7,9,12 |
| WordPress evasion | Scripts avoiding display for logged-in administrators, WordPress cookies, crawlers, or repeated visits. | Test as logged-out and logged-in users from clean browsers and external vantage points. | 1 |
| Endpoint behavior | Browser process leading to PowerShell, Terminal, mshta, finger, curl, or script interpreters after fake verification pages. | Correlate browser history, clipboard use, command-line telemetry, PowerShell logs, and EDR parent/child process chains. | 5,6,7,9,12 |
| Network behavior | Connections to fake CAPTCHA domains, redirectors, TDS infrastructure, or payload hosts shortly after visiting a legitimate site. | Use DNS, proxy, EDR, and browser telemetry to tie the visitor's web session to execution and payload download. | 1,2,4,12,16 |
| Copied command artifact | Sanitized patterns include browser-delivered PowerShell downloaders, mshta/script retrieval, and finger-style command retrieval. Example defensive pattern only: `powershell <flags> <download-or-decode-stage>` or `finger <token>@<redacted-host> | <shell>`. | Preserve the exact clipboard string and command-line telemetry from affected endpoints. Do not paste recovered strings into a live shell; convert URLs/domains to defanged form for evidence handling. | 1,5,7,9,12 |
| Payload objective | Infostealer, RAT, wallet theft, credential theft, loader, or remote-access tooling following ClickFix execution. | Scope browser-stored credentials, wallets, session cookies, cloud tokens, email access, saved VPN/RMM credentials, new persistence, and outbound C2. Treat remote-control tooling as potential unauthorized hands-on-keyboard access. | 1,2,3,4,9 |
13-Threat Actor Glossary
The retained source set does not support a single named actor behind all ClickFix campaigns targeting WordPress. The correct framing is layered: ClickFix is the technique, compromised WordPress is the delivery vector, IClickFix and ErrTraffic are framework/ecosystem labels, and KongTuke is the strongest named threat cluster or TDS-style activity in this brief.
Where public reporting does not identify a real-world operator, PANDA treats that as an attribution gap rather than filling it with inference. That matters because scopers should not tell clients that every ClickFix-on-WordPress event is KongTuke, IClickFix, or ErrTraffic unless their own telemetry or a retained source supports the linkage.
| Name | What It Is | Boundary | Source |
|---|---|---|---|
| KongTuke | Named threat cluster / TDS-style activity associated with fake CAPTCHA and ClickFix variants, including compromised WordPress delivery paths. | The clearest named actor/cluster label in this brief, but still not proof that all WordPress ClickFix activity is KongTuke. | 3,14 |
| IClickFix | WordPress-targeting framework using ClickFix lures and compromised WordPress delivery. | Framework/campaign label. The retained sources do not identify a real-world operator or single named actor behind every IClickFix event. | 2,16 |
| ErrTraffic v3 / GlitchFix | ClickFix-capable distribution framework with panel, backdoor, WordPress, and EtherHiding-style infrastructure reporting. | Framework/ecosystem label. Separate from IClickFix and KongTuke unless source-specific infrastructure or campaign evidence connects them. | 4,13,15 |
| Rapid7 WordPress stealer operation | A documented operation using compromised WordPress sites to inject Cloudflare-themed ClickFix lures and deliver stealer payloads. | The retained Rapid7 source does not promote a named threat actor for the broader operation, so this page does not invent one. | 1 |
| ClickFix | Technique name for malicious copy/paste social engineering. | Not a single malware family, actor, intrusion set, or WordPress-only campaign. | 5,6,9 |
14-Common Questions Q&A
| Question | Answer |
|---|---|
| Who is behind these ClickFix-on-WordPress campaigns? | Public sources retained here do not identify one overarching actor behind the whole ecosystem. KongTuke is the clearest named threat cluster/TDS-style activity in this brief, while Rapid7's broader WordPress stealer operation is not publicly attributed to a named actor in the retained source. IClickFix and ErrTraffic are best treated as frameworks or delivery ecosystems unless a source ties a specific intrusion to a specific operator.1,2,3,4,13,14,15 |
| Are IClickFix, ErrTraffic v3, and KongTuke the same thing? | No. They overlap at the technique and delivery-vector level: compromised sites, fake verification prompts, and ClickFix-style execution. They should not be collapsed into one malware family, one actor, or one infrastructure set without source-specific linkage.2,3,4,13,14,15 |
| Why are WordPress sites useful for ClickFix delivery? | WordPress gives attackers scale, trusted domains, broad plugin/theme attack surface, and many small-business or organization-owned sites where injected JavaScript or backdoored components may not be noticed quickly. The lure starts from a real website, which can make the fake Cloudflare or CAPTCHA prompt feel more credible.1,2,4,10 |
| If our WordPress site served a ClickFix page, were visitors definitely compromised? | Not necessarily. Serving the lure is exposure; compromise usually requires the visitor to follow the fake verification instructions and execute the pasted command. Scope the website and endpoint evidence separately: page source and server logs for delivery, then browser-to-shell telemetry and payload artifacts for execution.1,5,6,9 |
| Does a Cloudflare-themed ClickFix page mean Cloudflare was compromised? | No. The retained sources describe Cloudflare or CAPTCHA impersonation as lure content. That is brand abuse and social engineering, not evidence that Cloudflare infrastructure was breached.1,2,5 |
| Is ClickFix written in JavaScript, Python, PHP, or something else? | ClickFix is a social-engineering technique, not one language or one malware family. In the WordPress delivery cases retained here, attackers commonly use injected JavaScript/HTML to display the lure and PHP backdoors or must-use plugins for persistence. On the victim endpoint, public reporting shows pasted commands that drive PowerShell or other script/interpreter execution. Python is not the defining language of ClickFix in this source set.1,4,5,7,9,12 |
| Where would ClickFix-related code be stored on a WordPress site? | Look for injected JavaScript or PHP persistence in `wp-content/plugins/`, `wp-content/mu-plugins/`, `wp-content/themes/<theme>/`, theme `functions.php`, template files, `uploads/` PHP files, modified `.htaccess`, suspicious changes under core directories, database options/posts/widgets, and unauthorized admin users. Also check external scripts loaded by otherwise legitimate pages.4,10,17,18 |
| Is there a public automatic removal tool for ClickFix on WordPress? | No universal public auto-removal tool can guarantee cleanup because ClickFix is not one codebase. WordPress security tools and hosting cleanup services can help identify known malware, injected files, and suspicious changes, but eradication still requires validating files, database content, users, credentials, plugins, themes, and persistence against known-good state.10,17,18 |
| Should victims rebuild the WordPress server from scratch? | Not every case requires a full rebuild, but rebuild is the higher-assurance path when root cause, persistence, file/database integrity, or hosting-account integrity cannot be established. A defensible rebuild means fresh WordPress core, trusted plugin/theme packages, audited content/database restore, credential rotation, patched hosting, and post-cleanup monitoring. Targeted cleanup can be reasonable only when evidence supports the full compromise boundary.10,17,18 |
15-Talking Points
Executive
"This is not merely a bad website banner. A compromised WordPress site can become a delivery point that tricks visitors into executing malware on their own endpoint. The business risk spans brand trust, user compromise, credential theft, and downstream incident response."
SOC / MDR
"Hunt this as a browser-to-shell event. The key chain is legitimate site visit, fake verification prompt, user paste-and-run action, script execution, payload retrieval, and stealer or RAT behavior."
WordPress Admin
"Look for unauthorized JavaScript, iframes, admin-ajax abuse, mu-plugin backdoors, unexpected admin users, recent plugin/theme changes, and external script loads that disappear when logged in as an administrator."
Client / Claims Scoping
"Ask two separate questions: was the client's WordPress site used as delivery infrastructure, and did any employee or visitor actually run the ClickFix command? If the command executed, scope for remote-control tooling, stolen browser data, cloud sessions, wallets, VPN credentials, and any downstream account misuse."
User Awareness
"A real CAPTCHA will not ask you to press Win+R, paste a command, open Terminal, or run PowerShell. That instruction is the red flag."
16-Decision Ready Actions
| Owner | Decision / Action | Priority |
|---|---|---|
| CISO / Security Leader | Treat ClickFix-on-WordPress as both a web compromise and endpoint execution risk, not only website defacement. | High |
| Web / WordPress Owner | Inventory plugins, themes, admin users, mu-plugins, external script loads, and hosting credentials across the WordPress estate. | High |
| Web / WordPress Owner | Decide cleanup versus rebuild based on evidence quality: if root cause, persistence, or file/database integrity is uncertain, rebuild from clean components and audited content. | High |
| SOC / Detection Engineering | Prioritize browser-to-shell process chains, clipboard-driven execution, fake CAPTCHA domains, and PowerShell/script download patterns. | High |
| IR / DFIR | If a user ran the command, scope for endpoint compromise and infostealer/RAT impact: browser passwords, session cookies, crypto wallets, cloud tokens, VPN/RMM credentials, persistence, and email access. | High |
| Legal / Claims | Treat execution as a possible data-access event until endpoint telemetry, credential access, exfiltration, remote-control activity, and account misuse are ruled out. | High |
| User Awareness | Train users that legitimate verification checks never ask them to press Win+R, paste commands, or run terminal instructions. | Medium |
17-Exploitable Technology Risks
| Risk | Why It Matters | Defensive Priority |
|---|---|---|
| Vulnerable plugins/themes | Exposed or abandoned components can create a site-specific access path, although the retained sources do not prove one universal vulnerability. 1,10 | Patch, remove abandoned plugins, enforce least privilege, and monitor file changes. |
| Weak or stolen WordPress admin credentials | Administrator access can permit script injection, plugin upload, and durable persistence. 10,17,18 | MFA for admins, unique passwords, no shared admin accounts, and login anomaly monitoring. |
| Must-use plugin / backdoor persistence | mu-plugins can load server-side code outside the normal plugin interface and survive superficial cleanup. 4,17,18 | Review wp-content/mu-plugins and hosting-level file integrity. |
| User execution trust gap | A patched endpoint can still be compromised when a user manually runs the supplied command. 5,6,9 | Restrict browser-to-shell execution where practical and train users that verification pages do not require terminal commands. |
19-Tier 0 Through Tier 8 Source Summary
| Tier | Trust Role | What This Tier Supports | Caveat | Sources |
|---|---|---|---|---|
| Tier 0 | Primary research | Rapid7, Sekoia, and Trend Micro establish the central claim: compromised WordPress sites are repeatedly used to display ClickFix lures and deliver malware. | Campaigns differ by framework, payload, infrastructure, and targeting. | 1,2,3 |
| Tier 1 | Technical / authoritative | LevelBlue, Microsoft, and MITRE support ErrTraffic v3 details, general ClickFix growth, and formal ATT&CK mapping. | MITRE maps behavior; it does not attribute a specific campaign. | 4,5,6,7 |
| Tier 2 | Detection and hardening | Red Canary and WordPress documentation add practical detection and hardening guidance; Wordfence and Sucuri add cleanup and rebuild decision context. | Local telemetry, hosting architecture, backups, and evidence quality determine exact response steps. | 9,10,14,17,18 |
| Tier 3-4 | Corroboration / community | Malwarebytes, SANS ISC, and Censys reinforce scale, command variants, and panel-driven mechanics. | Use stronger primary research for core claims where available. | 11,12,13 |
| Tier 8 | Expansion research | Sekoia's ErrTraffic update, ThreatFox's IClickFix tag, and cleanup guidance from Wordfence/Sucuri are useful for ongoing tracking, IOC retrieval, and eradication planning. | IOC feeds are volatile and cleanup guidance must be validated against local evidence before declaring eradication. | 15,16,17,18 |
20-About the Contributors
| Contributor | Who They Are / What They Do | Contribution & Why It Matters Here | Source |
|---|---|---|---|
| Rapid7 Labs | Primary campaign research | Provides the strongest current evidence that legitimate WordPress sites are being compromised and used to inject Cloudflare-themed ClickFix content. | 1 |
| Sekoia.io | Framework naming and tracking | Names and analyzes IClickFix and later ErrTraffic evolution, helping separate technique from framework. | 2,15 |
| Trend Micro | KongTuke research | Documents KongTuke's compromised-WordPress ClickFix abuse and malware delivery behavior. | 3 |
| LevelBlue SpiderLabs / Censys | ErrTraffic and panel insight | Explains ErrTraffic v3 and panel-driven ClickFix mechanics. | 4,13 |
| MITRE / Microsoft / Red Canary | Technique and detection framing | Provide standard technique language, ATT&CK mapping, and practical detection categories. | 5,6,7,8,9 |
| WordPress / Wordfence / Sucuri | Hardening and cleanup guidance | Provide source-backed cleanup boundaries: compare against known-good files, inspect database and users, remove backdoors, rotate credentials, and rebuild when integrity cannot be proven. | 10,17,18 |
21-Source Deconfliction
| Source Issue | Agreement / Difference | Tension or Contradiction | How To Use It |
|---|---|---|---|
| Technique vs. delivery vector | The source set supports ClickFix as the social-engineering technique and compromised WordPress as a recurring delivery vector for presenting the lure. | Some public language can collapse the technique, the website compromise, and the campaign framework into one label. | Keep the layers separate in stakeholder language and detection engineering. 1,2,5,6 |
| Cloudflare-themed lures | Sources describe attackers imitating Cloudflare-style verification or CAPTCHA prompts. | No source used here establishes that Cloudflare itself was compromised. | Describe this as brand impersonation or fake verification, not a Cloudflare breach. 1,2,5 |
| Named frameworks and clusters | IClickFix, ErrTraffic v3, and KongTuke all support the broader WordPress-delivered ClickFix pattern. | They are not proven to be one actor, one infrastructure set, or one malware family. | Use each name only where the source supports that framework or cluster. 2,3,4,13,14,15 |
| Actor attribution | KongTuke is treated by retained sources as a named threat cluster or TDS-style activity; IClickFix and ErrTraffic are described primarily as frameworks or delivery ecosystems. | The retained sources do not identify the real-world operators behind IClickFix, ErrTraffic, or Rapid7's broader WordPress stealer operation. | Separate named activity labels from human attribution. Do not imply one operator controls all WordPress ClickFix activity. 1,2,3,4,13,14,15 |
| Payload and impact variance | Public reporting includes stealers, RATs, loaders, wallet theft, and credential-theft paths after ClickFix execution. | The final payload can vary by campaign and by visit. | Scope both the WordPress delivery site and the endpoint that ran the pasted command. 1,2,3,4 |
| Cleanup vs. rebuild | Cleanup guidance supports removing injected files, database content, backdoors, unauthorized users, and vulnerable components; it also supports comparing against known-good code and backups. | There is no universal public auto-removal tool that can guarantee eradication for every ClickFix-on-WordPress compromise. | Use scanners/plugins as triage aids; rebuild from clean components when integrity, persistence, or root cause cannot be proven. 10,17,18 |
22-Real World Examples
The retained source set does not provide a publishable list of named endpoint-victim companies. These examples are still real-world evidence: they describe observed operations, affected website categories, and named frameworks or clusters using compromised WordPress sites to deliver ClickFix lures.
| Example | What It Shows | Boundary | Source |
|---|---|---|---|
| Rapid7 named compromised delivery sites | Rapid7 observed legitimate WordPress websites compromised to inject malicious JavaScript and present Cloudflare-style ClickFix verification content. Public examples included phatapunjab[.]pk, missionloans[.]com, wepro[.]ch, www[.]mrfpaint[.]com, and a U.S. Senate candidate webpage, with final payloads including Vidar, Impure Stealer, and VodkaStealer. | These are delivery-site examples from one research write-up. Do not infer one root cause, one actor, or that the website owner was the same as the endpoint victim. | 1 |
| 700+ Ghost CMS education/tech websites | Malwarebytes reported a large adjacent ClickFix campaign hijacking more than 700 Ghost-powered websites, including universities and technology companies, to inject fake Cloudflare verification content. | This supports ClickFix-at-scale and trusted-website abuse, but it is not WordPress-specific and should not be used as proof of a WordPress compromise count. | 11 |
| IClickFix | Sekoia named IClickFix as a WordPress-targeting framework that uses compromised WordPress sites, fake Cloudflare or Turnstile-style lures, and ClickFix execution to deliver malware. | Framework label, not proof every WordPress ClickFix case is IClickFix or that a single public actor operates all IClickFix activity. | 2,16 |
| ErrTraffic v3 / GlitchFix | LevelBlue, Censys, and Sekoia describe a ClickFix-capable framework involving WordPress backdoors, PHP must-use plugin persistence, obfuscated JavaScript injection, panel-driven modes, and EtherHiding-style infrastructure retrieval. | Use for ErrTraffic/GlitchFix-specific mechanics. Do not merge with KongTuke or IClickFix without source-specific infrastructure or telemetry linkage. | 4,13,15 |
| KongTuke | Trend Micro and Red Canary describe KongTuke as a named cluster or TDS-style activity abusing compromised WordPress sites and fake CAPTCHA / ClickFix delivery paths. | This is the clearest named cluster in the retained source set, but campaign behavior and payloads can change and not all WordPress ClickFix activity is KongTuke. | 3,14 |
| SANS ISC command-retrieval variants | SANS ISC documented live ClickFix variants using command-retrieval behavior such as finger.exe, reinforcing that the copied command, staging method, and retrieval path can vary across campaigns. | Use as operational and detection context. It does not by itself establish WordPress as the delivery vector for every observed command variant. | 12 |
| Named-victim boundary | Public sources identify compromised websites, campaign infrastructure, and frameworks more clearly than named endpoint-victim companies. For IR, treat both the WordPress site owner and downstream visitors as potentially affected populations until local evidence scopes impact. | Do not publish or imply a named victim company unless a source directly confirms that organization and the nature of impact. | 1,2,3,4,11,13,15 |
23-Public Victims / Disclosure Matrix
The retained sources do not support a stable list of confirmed endpoint-victim companies for this ClickFix brief. Public reporting names delivery sites, affected website categories, and framework activity more often than it names organizations whose users executed payloads. Treat each row below as scoped public disclosure, not as proof of endpoint compromise.
| Named Organization / Set | Confirmation Status | Who Reported It / How Disclosed | Scope Boundary |
|---|---|---|---|
| phatapunjab[.]pk, missionloans[.]com, wepro[.]ch, www[.]mrfpaint[.]com, and a U.S. Senate candidate webpage | Confirmed as named compromised delivery sites in public research | Rapid7 identified the sites while describing Cloudflare-style ClickFix injection and stealer payload delivery. 1 | Confirms site abuse or delivery infrastructure in the cited research; it does not automatically prove endpoint compromise for every visitor. |
| 700+ Ghost CMS education and technology websites | Confirmed as an adjacent ClickFix-scale disclosure, not WordPress-specific | Malwarebytes reported the campaign and named the affected website category set. 11 | Useful for trusted-site abuse context, but it should not be counted as a WordPress victim set. |
| IClickFix / ErrTraffic / KongTuke affected sites | Framework or cluster activity disclosed; individual victim naming varies by source | Sekoia, LevelBlue, Censys, Trend Micro, and Red Canary reported the activity patterns. 2,3,4,13,14,15,16 | Use for campaign scoping and detection logic. Do not convert framework names into confirmed victim organizations without direct source support. |
24-KEV and CVE Details
No single KEV or CVE explains this ecosystem. Individual compromised WordPress sites may involve known plugin/theme vulnerabilities, stolen credentials, hosting compromise, or malicious admin access. Treat CVE review as a site-specific root-cause step, not as the full explanation for ClickFix delivery.
25-MITRE ATT&CK Lifecycle Mapping
| Phase | ClickFix-on-WordPress Mapping | Defensive Evidence |
|---|---|---|
| Reconnaissance | Identify weakly administered or exploitable WordPress sites; no universal access path is established. 1,10 | Hosting logs, scanner activity, WordPress login attempts. |
| Resource Development | Prepare fake verification pages, redirectors, JavaScript loaders, and payload infrastructure. 1,2,3,4 | New domains, script hosts, traffic-distribution infrastructure, and fake CAPTCHA pages. |
| Initial Access | Gain WordPress or hosting access through a case-specific vulnerability, credential, administrator, or server compromise. 1,4,10 | New admin users, file changes, plugin changes, webshells, and hosting-panel activity. |
| Delivery | Inject code that selectively displays the ClickFix lure to visitors. 1,2,3,4,8 | Injected source, mu-plugin, admin-ajax abuse, external script loads, redirects, and cookie-based evasion. |
| Execution | The visitor follows fake verification instructions and runs the copied command. 5,6,7,9 | Browser-to-shell process chain, clipboard artifacts, command line, and PowerShell/script logs. |
| Actions on Objectives | The payload steals credentials, wallets, or sessions, or establishes remote access. 1,2,3,4 | Stealer artifacts, command-and-control traffic, token/credential access, persistence, and account misuse. |
26-Source Weighting / Relevance
| Weight | Sources | What They Can Support | What They Cannot Prove |
|---|---|---|---|
| Highest | Rapid7, Sekoia, Trend Micro, LevelBlue 1,2,3,4 | Observed WordPress delivery mechanics, named framework or cluster behavior, payloads, and source-specific scale. | That every operation shares one actor, framework, root cause, or victim population. |
| Authoritative | Microsoft and MITRE ATT&CK 5,6,7,8 | Technique definition, behavior mapping, and broadly applicable defensive framing. | WordPress-specific attribution or the current status of a particular incident. |
| Operational | Red Canary and official WordPress guidance 9,10 | Detection, hardening, and response priorities that translate the research into action. | A confirmed compromise or root cause in the reader's own environment. |
| Corroborating | SANS, Censys, ThreatFox, Wordfence, Sucuri, and expansion reporting 12,13,15,16,17,18 | Fresh variants, IOCs, panel context, and practical cleanup leads. | Standalone attribution, universal blocklists, or guaranteed eradication. |
27-Additional IntelliOS Threat Intel Products on This Topic
| Product | Last Updated | How It Extends This Brief |
|---|---|---|
| ClickFix Campaign Impacting WordPress — Campaign Card | 18-Jul-2026 | Canonical CARDS record for campaign aliases, time window, actor and framework boundaries, TTPs, impact, sources, and related products. |
| LeakNet ClickFix / Deno Intrusion Chain — Campaign Card | 17-Jul-2026 | A narrower, actor-linked ransomware intrusion chain that also uses ClickFix. It is related context, not evidence that LeakNet operates the WordPress campaigns in this brief. |
28-Notes
| Note | Detail |
|---|---|
| Daily AI Agent update | The ClickFix WordPress AI Monitoring Agent checks daily for material changes to delivery mechanics, payloads, remediation, attribution, source confidence, and public impact. Confirmed Page Alerts subscribers are notified only for a published edition or material revision. |
| No universal blocklist | ClickFix campaigns rotate delivery sites, command templates, payloads, and infrastructure. Treat public IOCs as leads that require current validation. |
| Victim naming boundary | Named compromised websites are not the same as named endpoint victims. Keep delivery-site abuse, visitor execution, and confirmed organizational impact separate. |
30-Version Change Log
| Version | Date | Changes |
|---|---|---|
| v1.7 | 18-JUL-2026 | Completed the FortiBleed-standard 32-card quality pass; added source-bounded Research Framing, decision-ready BLUF and stakeholder scoping, source weighting, evidence-qualified ATT&CK/CVE cards, a canonical ClickFix WordPress campaign card with explicit links, live Page Alerts, and the scheduled FORGE AI Monitoring Agent. |
| v1.0 | 23-JUN-2026 | Initial static PANDA Flash Threat Intel Brief for ClickFix campaigns targeting WordPress sites. |
| v1.1 | 24-JUN-2026 | Expanded threat-actor attribution boundaries and added Common Questions Q&A to clarify KongTuke, IClickFix, ErrTraffic, WordPress delivery, and Cloudflare impersonation. |
| v1.2 | 24-JUN-2026 | Added safe copied-command pattern examples, RAT/remote-access impact language, and IR/legal blast-radius scoping for endpoints where a user executed ClickFix instructions. |
| v1.3 | 24-JUN-2026 | Added language/runtime clarification, WordPress storage and persistence locations, cleanup tooling limits, and rebuild-versus-targeted-cleanup guidance. |
| v1.4 | 24-JUN-2026 | Refined Real World Examples to separate observed operations, frameworks, and website categories from confirmed named endpoint-victim companies. |
| v1.5 | 28-JUN-2026 | Updated the static reader to the FortiBleed standard: compact banner shell, right-side Intel Card Settings drawer, browser-saved card visibility/reorder controls, alert/share actions, and tighter card/table typography. |
| v1.6 | 28-JUN-2026 | Fixed banner cropping, reset AI Monitoring Agent update count to zero, added no-agent Page Alerts notice, and aligned ClickFix card count, defaults, and expanded cards with FortiBleed. |
29-Citations
Core Sources Answering the Topic
| # | Source | Publisher | Published | Why Used |
|---|---|---|---|---|
| 1 | When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation | Rapid7 | March 10, 2026 | Primary high-value research on legitimate WordPress websites compromised to inject Cloudflare-style ClickFix content, including WordPress-specific loader behavior, admin-cookie evasion, fake CAPTCHA content, PowerShell execution, and stealer payload delivery. |
| 2 | Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic | Sekoia.io | February 2026 | Primary research naming IClickFix as a WordPress-targeting framework that uses compromised WordPress sites, fake Cloudflare/Turnstile-style lures, and ClickFix execution to deliver malware. |
| 3 | Through the Lens of MDR: Analysis of KongTuke's ClickFix Abuse of Compromised WordPress Sites | Trend Micro | March 10, 2026 | Primary vendor research describing KongTuke activity that uses compromised WordPress sites, fake CAPTCHA lures, and ClickFix-style execution to deliver malware. |
| 4 | Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign | LevelBlue SpiderLabs | April 2026 | Technical research on ErrTraffic v3, compromised WordPress sites, PHP must-use plugin backdoors, obfuscated JavaScript injection, EtherHiding retrieval, and ClickFix delivery. |
| 5 | Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security | August 21, 2025 | Authoritative vendor analysis explaining the ClickFix social-engineering technique, malicious copy/paste execution, campaign growth, and Defender telemetry context. |
| 6 | T1204.004 - User Execution: Malicious Copy and Paste | MITRE ATT&CK | Living framework | Industry-standard mapping for ClickFix-style attacks that trick users into copying and pasting malicious commands. |
| 7 | T1059.001 - Command and Scripting Interpreter: PowerShell | MITRE ATT&CK | Living framework | Framework mapping for PowerShell execution frequently used after ClickFix lures convince a user to run pasted commands. |
| 8 | T1189 - Drive-by Compromise | MITRE ATT&CK | Living framework | Framework mapping for legitimate websites compromised or abused to deliver malicious content to visitors. |
| 9 | Malicious Copy and Paste | Red Canary | 2026 Threat Detection Report | Practitioner detection guidance on malicious copy-and-paste behaviors, user-execution telemetry, command-line patterns, and ClickFix-style response framing. |
| 10 | Hardening WordPress | WordPress Developer Resources | Living documentation | Official WordPress hardening guidance for reducing compromise risk through updates, access control, least privilege, file permissions, backups, and security hygiene. |
| 11 | 700+ education and tech websites hijacked in huge ClickFix malware campaign | Malwarebytes | May 2026 | Corroborating research/news on high-volume website compromise and fake Cloudflare/CAPTCHA ClickFix delivery, useful for showing scale and adjacent CMS delivery risk. |
| 12 | ClickFix Attacks Still Using the Finger | SANS Internet Storm Center | December 2025 | Practitioner/community research showing ClickFix command variants, fake CAPTCHA pages, and KongTuke-related command retrieval behavior. |
| 13 | ErrTraffic: Inside a GlitchFix Attack Panel | Censys | January 2026 | Expansion research on ErrTraffic/GlitchFix panel modes, including ClickFix mode, command execution instructions, and panel-driven delivery mechanics. |
| 14 | KongTuke | Red Canary | 2026 Threat Detection Report | Expansion research on KongTuke and its shift into fake CAPTCHA / ClickFix variants, useful for separating the technique from a named threat cluster. |
Expansion Research Sources
| # | Source | Publisher | Published | Why Used |
|---|---|---|---|---|
| 15 | Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework | Sekoia.io | June 2026 | Expansion research connecting ErrTraffic evolution, v3, ClickFix distribution, and related infrastructure changes. |
| 16 | IClickFix Malware Family | Abuse.ch ThreatFox | Living IOC database | Expansion source for defenders who need tagged IClickFix indicators and API-based IOC retrieval outside this high-level brief. |
| 17 | How to Clean a Hacked WordPress Site using Wordfence | Wordfence | Living guidance | Expansion guidance for WordPress cleanup, file comparison against known-good core/theme/plugin copies, malware/backdoor removal, and limits of automated repair. |
| 18 | How to Remove Malware & Clean a Hacked WordPress Site | Sucuri | Living guidance | Expansion guidance on hacked WordPress cleanup, comparing to known-good backups, checking modified files, cleaning files and database tables, reviewing users, removing backdoors, and deciding when restore/rebuild is appropriate. |