Overview
- Check Point disclosed in mid‑August that researchers found close to 2,000 compromised WordPress domains being used to host malware stages, issue commands and store exfiltrated data.
- The attack begins with a ClickFix fake CAPTCHA that tells visitors to paste and run a PowerShell command, which launches a staged .NET downloader chain that pulls the main payloads.
- The intruders deployed a six‑module toolkit that included a file encryptor, an SMB/USB worm, a lockscreen, a credential stealer, a VBS spreader and a custom chat tool for direct operator interaction.
- One data‑theft module, SilentDataCollector, harvested files and passwords, captured keystrokes, took screenshots every 30 seconds and could automate WhatsApp searches to capture contact details.
- Researchers recovered exposed operator directories after OPSEC errors and collected more than 31,000 screenshots, over 700 stolen archives and logs tied to about 6,000 unique victim IPs, and they urged site owners to patch WordPress, remove unknown must‑use plugins, monitor PowerShell activity and train users not to run commands from web CAPTCHA prompts.