Listen to this Post
A New Kind of WordPress Infection
A quiet but highly sophisticated malware campaign is turning ordinary WordPress websites into launchpads for Windows information-stealing malware. Instead of relying on obvious malicious downloads or noisy website defacements, attackers are combining compromised WordPress infrastructure, browser Service Workers, blockchain-based payload storage, fake CAPTCHA pages, ClickFix social engineering, steganography, and fileless PowerShell execution.
The campaign has reportedly affected hundreds of WordPress websites and demonstrates how modern attackers are increasingly building multi-stage infection chains designed to hide every important component from conventional security controls.
What makes this operation particularly concerning is that the compromised website is only the beginning. The malicious code can remain active in a visitor’s browser through a rogue Service Worker, while the actual payload is stored outside the infected server on the Base blockchain. From there, the victim can be manipulated into executing a command, which ultimately delivers Amatera, a Windows password stealer also associated with the names ACR Stealer and AcridRain.
This is no longer the classic model of “visit an infected website and download malware.”
It is a carefully engineered attack designed to make every stage look legitimate.
The Attack Begins Inside WordPress
Researchers observed attackers planting a malicious must-use WordPress plugin on compromised websites.
The plugins reportedly follow naming patterns such as site-helper-
Unlike ordinary plugins that administrators can easily activate or deactivate through the WordPress dashboard, must-use plugins operate differently and can therefore provide attackers with a particularly useful persistence mechanism.
Once installed, the rogue plugin becomes part of the site’s normal execution flow.
Why the Infection Can Remain Hidden
The attackers are not simply injecting malicious JavaScript into every visitor’s browser.
That would be too obvious.
Instead, the campaign reportedly uses selective targeting.
The malicious code avoids WordPress administrators, authenticated users, /wp-admin, and /wp-login.php. This significantly reduces the likelihood that the legitimate website owner will encounter the malicious behavior while managing the site.
For attackers, this is an extremely practical strategy.
A normal visitor may receive the malicious content while the administrator sees an apparently clean website.
That separation creates a dangerous blind spot.
The Service Worker Gives Attackers Persistence
One of the most interesting components of the campaign is its use of a malicious browser Service Worker.
Service Workers are legitimate browser technology. Websites use them for capabilities such as caching, offline functionality, background tasks, and progressive web applications.
The problem is that the same technology can become extremely powerful when abused.
In this campaign, the compromised WordPress site registers a rogue Service Worker inside the visitor’s browser. The Service Worker can then intercept browser requests and manipulate responses.
That means the attacker does not necessarily have to inject malicious content into every individual webpage request.
The browser itself becomes part of the attack infrastructure.
Removing Security Headers
The malicious Service Worker reportedly intercepts requests and removes Content-Security-Policy (CSP) headers before modifying HTML content.
CSP is an important browser security mechanism that can restrict which scripts, resources, frames, connections, and other content a website is allowed to load.
Removing CSP protections can make subsequent JavaScript injection significantly easier.
This creates an important lesson for defenders: a website can appear technically healthy at the server level while malicious browser-side behavior continues through previously registered client-side components.
EtherHiding Moves the Payload Off the Server
The campaign becomes even more unusual when the attackers introduce blockchain infrastructure.
The injected code communicates with a smart contract on the Base blockchain network. The contract is used as an external storage and control mechanism for campaign content, including scripts and HTML associated with the fake CAPTCHA experience.
This technique is commonly described as EtherHiding.
Instead of storing every malicious component directly on the compromised WordPress server, attackers can place portions of their infrastructure on blockchain-related resources.
That creates another layer between the victim and the actual malicious payload.
Why Blockchain Storage Is Attractive to Attackers
Traditional malware infrastructure can be taken down.
A malicious domain can be blocked.
A compromised server can be cleaned.
A hosting provider can terminate an account.
Blockchain-based infrastructure introduces a different set of challenges because data associated with smart contracts can be difficult to remove or alter once published, depending on how the contract is designed.
In this campaign, the smart contract reportedly acts as a mutable registry for malicious scripts and payload information.
For defenders, that means blocking the compromised WordPress site alone may not be enough.
The external infrastructure supporting the campaign also has to be understood.
The Fake CAPTCHA Is the Psychological Trigger
After the technical setup is complete, the attack becomes much more human.
Victims are shown what appears to be a Google reCAPTCHA-style verification page.
The message claims that unusual traffic has been detected and asks the visitor to prove that they are human.
This is a familiar interaction.
That familiarity is exactly what makes it effective.
People have become accustomed to clicking CAPTCHA boxes when visiting websites, so the attacker is exploiting an established behavioral pattern rather than asking the victim to do something obviously suspicious.
ClickFix Turns the Victim Into the Execution Engine
The fake CAPTCHA reportedly uses a ClickFix-style technique.
After interacting with the fake verification screen, the victim is instructed to open the Windows Run dialog, paste a command, and execute it.
This changes the nature of the attack.
Instead of the browser silently downloading and executing a suspicious file, the attacker convinces the user to perform the critical action themselves.
That can make the infection chain more difficult for certain automated defenses to detect because the final execution originates from an apparently legitimate user interaction.
The victim effectively becomes the mechanism that bridges the browser attack and the Windows malware stage.
The Abuse of mshta.exe
The command ultimately abuses the legitimate Windows utility mshta.exe to retrieve and execute malicious content.
mshta.exe is a genuine Microsoft Windows component associated with HTML Applications.
Like many legitimate system utilities, however, it can be abused by attackers.
This is an example of a living-off-the-land strategy: rather than introducing a custom executable at the first opportunity, attackers use software already present on the operating system.
That approach can complicate detection because security teams must distinguish legitimate administrative activity from suspicious execution patterns.
A File That Pretends to Be an MP3
The downloaded component reportedly uses another clever trick.
It is a polyglot file, meaning it can satisfy the structural expectations of more than one file format.
In this case, the file appears to be an MP3 while also containing an embedded HTA application.
To a casual observer, it may look like an ordinary audio file.
To the attack chain, however, it contains another executable component.
This illustrates why relying solely on filename extensions is increasingly dangerous.
A file called something.mp3 does not necessarily behave like an ordinary audio file.
The Attack Moves Into Fileless PowerShell
The HTA stage reportedly creates a hidden scheduled task and launches a PowerShell-based stage.
The attackers attempt to minimize the amount of malicious content written directly to disk.
This is often referred to as fileless or memory-focused execution.
The objective is straightforward: reduce the number of artifacts that traditional file-based antivirus systems can inspect.
The campaign also reportedly attempts to interfere with or bypass Antimalware Scan Interface (AMSI) protections.
AMSI is designed to allow security products to inspect potentially malicious scripts and content before or during execution.
Interfering with those inspection mechanisms can provide attackers with another opportunity to conceal the next stage.
Emmenhtal Becomes the Next Link
The PowerShell stage reportedly downloads the Emmenhtal loader from infrastructure designed to resemble Bitdefender GravityZone.
This is another important element of the campaign.
Attackers are not only disguising their files.
They are also disguising their infrastructure.
Security products and well-known vendors are familiar names to enterprise users, so an infrastructure domain that resembles a legitimate security provider can appear less suspicious at first glance.
This is classic impersonation combined with a much more modern multi-stage delivery architecture.
Malware Hidden Inside a JPEG
Emmenhtal then reportedly retrieves a JPEG image from a legitimate image CDN.
At first glance, there is nothing suspicious about downloading a JPEG from a legitimate content-delivery infrastructure.
But the image reportedly contains encrypted malware hidden inside its pixel data.
This is steganography.
Rather than embedding malware inside an obviously executable file, attackers hide information inside something that appears to be an ordinary image.
The technique is especially attractive because organizations may be reluctant to block legitimate image CDNs.
Trusted Infrastructure Becomes Part of the Attack
The use of a legitimate image CDN demonstrates a broader trend in modern malware operations.
Attackers increasingly try to blend malicious traffic into normal internet activity.
A request to a suspicious domain may immediately trigger an investigation.
A request for a JPEG from infrastructure that serves countless legitimate images is much easier to overlook.
This does not make legitimate CDNs malicious.
It demonstrates that defenders increasingly need to analyze behavior and context, not simply reputation.
The Final Payload: Amatera
After the hidden payload is extracted, the loader reportedly executes the malware directly in memory.
The final payload is Amatera, a Windows information-stealing malware family also described as a rebrand of ACR Stealer or AcridRain.
Its capabilities reportedly include credential theft, system information collection, communication with command-and-control infrastructure, and DNS-over-HTTPS communication.
The use of DNS-over-HTTPS can further complicate network monitoring because DNS queries can be transported through encrypted HTTPS traffic rather than appearing as traditional DNS requests.
Disguised as WPA.exe
The malware reportedly masquerades as WPA.exe.
That filename is designed to resemble
Filename masquerading is hardly a new technique.
What has changed is where it appears in the infection chain.
By the time the victim reaches the final executable, the attack has already passed through WordPress, the browser, blockchain infrastructure, a fake CAPTCHA, Windows utilities, a polyglot file, PowerShell, a loader, and steganography.
The complexity itself becomes a defensive challenge.
A Second Delivery Method Exists
Researchers also linked another infection method to the same operation.
In that variant, the malicious WordPress plugin injects code directly into webpages rather than relying on a browser Service Worker.
Although the delivery mechanism differs, researchers reportedly identified overlapping infrastructure, including the same Base smart contract, telemetry mechanisms, and on-chain scripts.
This strongly suggests that the operators are not tied to a single delivery mechanism.
They have built an adaptable platform.
Why This Campaign Matters
The most important lesson is not simply that WordPress websites are being compromised.
The bigger story is the combination of techniques.
Attackers are connecting technologies that were never designed to work together maliciously: WordPress plugins, browser Service Workers, blockchain smart contracts, CAPTCHA interfaces, Windows utilities, PowerShell, image CDNs, and steganography.
Each individual component can look relatively ordinary.
Together, they form a sophisticated malware delivery system.
Deep Analysis: Breaking Down the Attack Chain
Stage 1 — WordPress Persistence
The first objective is gaining persistence on the website.
The rogue must-use plugin provides attackers with a way to execute code automatically whenever WordPress loads.
Defenders should therefore inspect the WordPress must-use plugin directory and compare files against known-good baselines.
For example, administrators can begin an investigation with defensive commands such as:
find wp-content/mu-plugins -type f -printf '%TY-%Tm-%Td %TH:%TM %p ' | sort
This helps identify recently modified files and unusual plugin additions.
Stage 2 — Browser Persistence
The next stage moves from the server to the visitor.
A malicious Service Worker can remain registered in a browser and potentially continue influencing requests after the initial page interaction.
During incident response, security teams should investigate unexpected Service Worker registrations associated with compromised websites.
Browser developer tools can also be used during controlled investigation to inspect:
Application → Service Workers
Application → Cache Storage
Application → IndexedDB
Network → Requests
Stage 3 — HTML Manipulation
The malicious Service Worker reportedly intercepts requests and modifies returned content.
One defensive approach is to compare server-generated HTML against what is actually delivered to a clean browser session.
Security teams can also inspect response headers for unexpected differences, especially around:
Content-Security-Policy
Content-Type Cache-Control Service-Worker-Allowed
A missing CSP header is not automatically evidence of compromise, but an unexpected change should be investigated.
Stage 4 — Blockchain-Based Payload Retrieval
The
Instead of searching only for malicious files on the compromised WordPress server, analysts should correlate browser telemetry, JavaScript network requests, blockchain addresses, and campaign infrastructure.
The reported smart-contract indicator is:
0x58460d0b3d4d6b03761c89120393c0c676676496
Security teams should validate this indicator through controlled threat-intelligence systems rather than interacting with unknown infrastructure directly.
Stage 5 — ClickFix Detection
The fake CAPTCHA stage deserves particular attention.
Security awareness teams should teach users that legitimate CAPTCHA systems should not normally instruct them to open the Windows Run dialog and manually execute commands.
A simple rule can save an organization from a complicated infection:
Never paste an unknown command into Windows Run, PowerShell, Command Prompt, or Terminal merely because a webpage tells you to do so.
Stage 6 — Monitoring mshta.exe
Defenders should pay close attention to unexpected mshta.exe activity.
For Windows environments, security teams can search process telemetry for suspicious parent-child relationships involving mshta.exe.
For example, Microsoft Defender environments can investigate process events using queries conceptually similar to:
DeviceProcessEvents
| where FileName =~ mshta.exe
| project Timestamp, DeviceName, InitiatingProcessFileName,
ProcessCommandLine, AccountName
| order by Timestamp desc
The exact query should be adapted to the organization’s Microsoft Defender schema and logging configuration.
Stage 7 — PowerShell Investigation
PowerShell activity should also be correlated with the preceding mshta.exe event.
Investigators should look for unusual chains such as:
Browser
↓
mshta.exe
↓
powershell.exe
↓
Scheduled Task
↓
Loader
↓
Information Stealer
A single PowerShell event may be legitimate.
The complete process chain can reveal the attack.
Stage 8 — AMSI and Script Telemetry
Attempts to interfere with AMSI should be treated as a high-priority signal when combined with suspicious PowerShell execution.
Security teams should ensure that PowerShell logging, script-block logging where appropriate, endpoint telemetry, and other defensive controls are enabled according to organizational policy.
The objective is not merely to block PowerShell.
It is to understand why PowerShell was launched, by which process, with what command line, and what happened immediately afterward.
Stage 9 — Detecting Steganographic Payloads
Traditional antivirus scanning may not immediately flag a normal-looking JPEG.
Defenders can therefore investigate unusual relationships between image downloads and subsequent process creation.
A suspicious pattern could look like:
powershell.exe
↓
downloads JPEG
↓
reads image bytes
↓
decrypts/extracts embedded data
↓
reflective execution
The sequence is more valuable than the file extension.
Stage 10 — Amatera Detection
The final stage involves credential theft and system reconnaissance.
Organizations should investigate endpoints where suspicious executables imitate legitimate Windows tools, particularly when those files appear in unusual directories or are launched by unexpected parent processes.
File names alone should never be considered proof of legitimacy.
Hash-based intelligence, digital signatures, file locations, process ancestry, network behavior, and endpoint telemetry should all be correlated.
Indicators of Compromise
The reported campaign includes the following indicators:
Base smart contract:
0x58460d0b3d4d6b03761c89120393c0c676676496
Reported domain:
ultraspeed[.]pro
The domain is intentionally defanged to prevent accidental navigation.
Organizations should enrich these indicators through controlled threat-intelligence platforms, SIEM systems, endpoint telemetry, DNS logs, proxy logs, and malware-analysis environments before taking response actions.
How Defenders Can Protect WordPress Sites
Audit Must-Use Plugins
Administrators should regularly inspect WordPress must-use plugins and maintain a known-good inventory.
Unexpected additions should be treated as potentially suspicious, particularly when the file name is unfamiliar or the file appeared without an authorized deployment.
Monitor File Changes
File-integrity monitoring can help detect unauthorized changes inside WordPress installations.
Pay particular attention to:
wp-content/mu-plugins/
wp-content/plugins/
wp-content/themes/
wp-config.php
.htaccess
Unexpected modifications should trigger investigation.
Review Administrator Accounts
Attackers who install persistent WordPress malware may also create or compromise administrator accounts.
Review privileged accounts regularly and remove accounts that are no longer required.
Strengthen Authentication
Strong administrator passwords, phishing-resistant authentication where available, limited administrative access, and appropriate multi-factor authentication can significantly reduce the risk of account takeover.
Keep WordPress Components Updated
WordPress core, plugins, and themes should be updated through controlled processes.
Unused plugins and themes should be removed rather than simply left disabled.
Every additional component expands the
Monitor Browser-Side Behavior
Traditional server monitoring is not enough for attacks involving Service Workers.
Organizations should consider browser telemetry, CSP monitoring, web application security monitoring, and client-side integrity controls where appropriate.
Why Service Workers Deserve More Security Attention
Service Workers are increasingly important to modern websites.
They can improve performance, support offline functionality, and enable sophisticated web applications.
But they also introduce a persistent browser execution layer.
If an attacker successfully registers a malicious Service Worker, simply removing the original JavaScript injection may not immediately eliminate every client-side artifact.
This means incident response teams need to think beyond server compromise.
The browser itself can become part of the persistence mechanism.
The Bigger Threat: Attack Chains Are Becoming Modular
One of the most striking characteristics of this campaign is its modularity.
If one hosting provider is blocked, another can potentially be used.
If one delivery mechanism becomes ineffective, another can inject directly into webpages.
If a malicious executable is easier to detect, the operators can hide the payload inside an image.
If direct malware downloads are blocked, social engineering can convince the victim to execute a command.
This is an ecosystem rather than a single malicious file.
What Undercode Say:
The Website Is No Longer the Final Target
The compromised WordPress website is merely the doorway.
The real objective is the
Trust Is Being Weaponized
Attackers are abusing things people already trust: WordPress, CAPTCHA pages, Microsoft utilities, image files, CDNs, and security-vendor branding.
The Browser Has Become Part of the Attack Surface
Service Workers demonstrate how browser functionality can become a persistence layer when websites are compromised.
Blockchain Adds Another Layer
EtherHiding makes infrastructure investigation more complicated because payload information can exist outside conventional hosting environments.
Fake CAPTCHAs Are Becoming Dangerous
Users should learn that a CAPTCHA should never require them to execute an unknown operating-system command.
ClickFix Is a Human-Focused Attack
The technique succeeds because it manipulates behavior rather than relying exclusively on software exploitation.
Legitimate Windows Utilities Can Be Dangerous in Context
mshta.exe is not inherently malicious.
Its presence in a suspicious execution chain is what makes it important.
File Extensions Are Weak Evidence
An MP3 can contain something other than audio.
A JPEG can contain hidden data.
A filename is not a security guarantee.
Steganography Is Still Relevant
Attackers continue to use ordinary-looking media to transport malicious content.
Fileless Execution Changes Detection
When fewer malicious artifacts are written to disk, endpoint telemetry becomes increasingly important.
PowerShell Requires Context
Blocking every PowerShell action is impractical.
Understanding its parent process, command line, user, timing, and network activity is more valuable.
Security Headers Matter
CSP can provide an important layer of browser-side protection.
Unexpected changes deserve investigation.
Web Security and Endpoint Security Are Converging
The attack begins on a web server and ends with credential theft on Windows.
That means separate security silos can miss the complete chain.
WordPress Administrators Need Better Visibility
Must-use plugins deserve the same scrutiny as ordinary plugins.
Persistent Browser State Complicates Cleanup
Removing malicious server code does not necessarily mean every browser-side artifact disappears immediately.
Incident Response Must Include Clients
Cleaning the WordPress server is only one part of the response.
Potentially exposed visitors and endpoints may also require investigation.
DNS-over-HTTPS Can Hide Network Signals
Encrypted DNS makes traditional DNS monitoring less effective on its own.
Domain Reputation Is Not Enough
A malicious request may be hidden among legitimate web traffic.
Behavioral detection is increasingly important.
CDNs Can Be Abused Without Being Malicious
A legitimate CDN can become part of an attack chain without the CDN itself being compromised.
Impersonation Remains Powerful
Security-vendor branding can make malicious infrastructure appear credible.
Attackers Are Combining Old and New Techniques
PowerShell and social engineering are not new.
Blockchain payload storage and Service Worker persistence add newer layers to the same fundamental objective.
Complexity Is a Defensive Weapon
Every additional stage creates another opportunity for defenders to detect the attack.
But it also creates another layer that must be understood.
Security Teams Should Correlate Events
A browser request by itself may look harmless.
An mshta.exe process alone may also have a legitimate explanation.
Together, the events can tell a very different story.
Telemetry Is Becoming More Valuable Than Signatures
Modern attacks can change files, domains, and delivery mechanisms.
Behavioral patterns are harder to disguise completely.
WordPress Security Is Endpoint Security
A compromised website can become the starting point for infections across thousands of visitors.
Website Owners Have a Larger Responsibility
A vulnerable or compromised site can harm people who have never heard of its owner.
Users Also Need Security Awareness
A technically sophisticated attack can still depend on one human decision.
ClickFix Shows the Power of Social Engineering
The victim may unknowingly perform the most important execution step themselves.
Security Education Should Explain Why
Simply telling users
They should understand why browser instructions to execute commands are dangerous.
Defenders Should Assume Adaptation
If this
Threat Hunting Should Follow the Chain
Start with WordPress.
Move to browser activity.
Then inspect Windows processes.
Then investigate network connections and credential access.
The Most Dangerous Component May Be the Combination
None of these techniques is necessarily revolutionary by itself.
The danger comes from how effectively they are chained together.
Trust Boundaries Are Disappearing
The boundary between website security, browser security, endpoint security, and identity security is becoming increasingly blurred.
Security Architecture Must Reflect That Reality
Organizations need visibility across those layers.
The Campaign Is a Warning for WordPress Owners
A clean-looking homepage does not prove a WordPress installation is clean.
It Is Also a Warning for Enterprises
Employees browsing legitimate websites can still encounter sophisticated malware delivery chains.
The Browser Should Be Treated as an Endpoint
Modern browsers execute increasingly complex applications and maintain persistent state.
Blockchain Does Not Make Malware Invisible
It simply changes where investigators need to look.
Steganography Does Not Make Malware Undetectable
It changes the analytical problem from “what file was downloaded?” to “what happened after the file was downloaded?”
Human Behavior Remains the Critical Variable
The final defense can sometimes be as simple as refusing to execute a command supplied by a webpage.
The Most Important Lesson
Modern malware campaigns are no longer built around one malicious executable.
They are built around chains of trust, deception, persistence, and execution.
And that means defending them requires breaking the chain at any point possible.
✅ WordPress Must-Use Plugins Can Provide Automatic Persistence
Must-use plugins are a legitimate WordPress mechanism that loads automatically.
An attacker who manages to place a malicious file there can abuse that behavior for persistence.
The reported site-helper-
✅ Service Workers Can Intercept Web Requests
Service Workers legitimately have the ability to intercept and respond to browser requests.
That capability can be abused when an attacker controls the registration process.
The security significance depends on the exact scope, permissions, browser state, and origin involved.
✅ EtherHiding Is a Real Malware-Delivery Concept
Attackers have experimented with blockchain and smart-contract infrastructure as a place to store or retrieve malicious information.
This can complicate conventional takedown and infrastructure-blocking strategies.
The specific Base contract cited in this campaign should be independently validated against current threat-intelligence reporting.
✅ ClickFix Is a Recognized Social-Engineering Technique
ClickFix-style attacks manipulate users into performing actions such as copying and executing commands.
The approach is effective because the victim becomes an active participant in the infection process.
Organizations should specifically include this behavior in security-awareness training.
✅ mshta.exe Is a Legitimate Windows Component
mshta.exe is a genuine Windows utility.
Like other legitimate system binaries, it can be abused by attackers.
Its presence should therefore be evaluated using execution context rather than treated as automatically malicious.
✅ Steganography Can Hide Data Inside Images
Information can be concealed inside digital images using steganographic techniques.
Malware campaigns have used this concept to make payload retrieval appear like ordinary image traffic.
Detection generally requires correlating file content and subsequent behavior rather than relying on extensions.
⚠️ Amatera Naming and Lineage Require Careful Attribution
Amatera, ACR Stealer, and AcridRain have been associated with overlapping malware descriptions in security reporting.
However, naming conventions and malware-family relationships can vary between researchers and vendors.
Defenders should rely on hashes, capabilities, infrastructure, and technical analysis rather than assuming every naming label represents a distinct malware family.
⚠️ “Hundreds of Websites” Should Be Treated as a Reported Campaign Scope
The supplied article states that hundreds of WordPress websites were affected.
That figure should be attributed to the
The true number of compromised sites could be higher or lower.
Prediction
(+1) Defenders Will Become Much More Focused on Browser Persistence
As Service Workers and increasingly sophisticated web applications become common, security teams will pay greater attention to browser-side persistence mechanisms.
(+1) ClickFix Detection Will Become Standard Security Training
Organizations are likely to add fake CAPTCHA and “copy this command” scenarios to employee awareness programs.
(+1) Blockchain Infrastructure Will Receive More Threat-Intelligence Attention
As attackers experiment with smart contracts and decentralized infrastructure, security researchers will increasingly monitor blockchain activity alongside conventional domains and IP addresses.
(+1) Behavioral Detection Will Continue Replacing Simple Indicators
Security teams will increasingly correlate process trees, browser behavior, network requests, and file activity instead of depending exclusively on domains, hashes, or filenames.
(-1) Multi-Stage Web-to-Endpoint Attacks Will Become More Common
The combination of compromised websites, social engineering, legitimate system utilities, and credential stealers creates an attractive model for cybercriminals.
(-1) Fake CAPTCHA Attacks Could Become More Convincing
As users become familiar with current ClickFix campaigns, attackers are likely to improve the visual design and social-engineering narratives used to persuade victims.
(-1) WordPress Remains a High-Value Launch Platform
The enormous number of WordPress installations means that compromised websites can potentially provide attackers with access to large and diverse pools of visitors.
Final Takeaway
This campaign represents a powerful example of how modern malware delivery is evolving.
The attacker does not need the victim to download an obviously malicious executable.
Instead, the chain begins with a compromised WordPress website, moves into the browser through a Service Worker, retrieves instructions from blockchain infrastructure, displays a convincing CAPTCHA, persuades the user to execute a command, abuses a legitimate Windows utility, launches PowerShell, retrieves a disguised payload, hides another component inside an image, and finally deploys an information stealer.
Every stage attempts to look normal.
That is what makes the operation dangerous.
For WordPress administrators, the message is clear: inspect must-use plugins, monitor unexpected file changes, review authentication activity, and investigate unexplained browser-side modifications.
For security teams, the lesson is even broader: the next malware infection may not begin with a malicious file. It may begin with a perfectly ordinary webpage.
And for users, one rule deserves to be remembered above all others:
A website should never convince you to open Windows Run and execute an unknown command simply to prove that you are human.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.reddit.com/r/AskReddit
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
