Cybersecurity researchers are calling consideration to a nefarious marketing campaign focusing on WordPress websites to make malicious JavaScript injections which might be designed to redirect customers to sketchy websites.
“Website guests get injected content material that was drive-by malware like faux Cloudflare verification,” Sucuri researcher Puja Srivastava stated in an evaluation printed final week.
The web site safety firm stated it started an investigation after one among its buyer’s WordPress websites served suspicious third-party JavaScript to website guests, in the end discovering that the attackers launched malicious modifications to a theme-related file (“features.php”).
The code inserted into “features.php” incorporates references to Google Advertisements, probably in an try to evade detection. However, in actuality, it features as a distant loader by sending an HTTP POST request to the area “brazilc[.]com,” which, in flip, responds with a dynamic payload that features two elements –
- A JavaScript file hosted on a distant server (“porsasystem[.]com”), which, as of writing, has been referenced on 17 web sites and incorporates code to carry out website redirects
- A bit of JavaScript code that creates a hidden, 1×1 pixel iframe, inside which it injects code that mimics legit Cloudflare belongings like “cdn-cgi/challenge-platform/scripts/jsd/major.js” – an API that is a core a part of its bot detection and problem platform
It is price noting that the area “porsasystem[.]com” has been flagged as half of a site visitors distribution system (TDS) referred to as Kongtuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124).
In line with data shared by an account named “monitorsg” on Mastodon on September 19, 2025, the an infection chain begins with customers visiting a compromised website, ensuing within the execution of “porsasystem[.]com/6m9x.js,” which then results in “porsasystem[.]com/js.php” to ultimately take the victims to ClickFix-style pages for malware distribution.
The findings illustrate the necessity for securing WordPress websites and guaranteeing that plugins, themes, and web site software program are stored up-to-date, implementing robust passwords, scanning the websites for anomalies and sudden administrator accounts created for sustaining persistent entry even after the malware is detected and eliminated.
Create ClickFix Pages Utilizing IUAM ClickFix Generator
The disclosure comes as Palo Alto Networks Unit 42 detailed a phishing equipment named IUAM ClickFix Generator that enables attackers to contaminate customers with malware by leveraging the ClickFix social engineering method and give you customizable touchdown pages by mimicking browser verification challenges typically used to dam automated site visitors.
“This instrument permits risk actors to create extremely customizable phishing pages that mimic the challenge-response habits of a browser verification web page generally deployed by Content material Supply Networks (CDNs) and cloud safety suppliers to defend towards automated threats,” safety researcher Amer Elsad stated. “The spoofed interface is designed to look legit to victims, growing the effectiveness of the lure.”
The bespoke phishing pages additionally include capabilities to control the clipboard, an important step within the ClickFix assault, in addition to detect the working system used with a purpose to tailor the an infection sequence and serve suitable malware.
In not less than two totally different circumstances, risk actors have been detected utilizing pages generated utilizing the equipment to deploy data stealers akin to DeerStealer and Odyssey Stealer, the latter of which is designed to focus on Apple macOS programs.
The emergence of the IUAM ClickFix Generator provides to a previous alert from Microsoft warning of an increase in industrial ClickFix builders on underground boards since late 2024. One other notable instance of a phishing equipment that has built-in the providing is Affect Options.
“The kits provide creation of touchdown pages with a wide range of obtainable lures, together with Cloudflare,” Microsoft famous again in August 2025. “Additionally they provide development of malicious instructions that customers will paste into the Home windows Run dialog. These kits declare to ensure antivirus and internet safety bypass (some even promise that they’ll bypass Microsoft Defender SmartScreen), in addition to payload persistence.”
It goes with out saying that these instruments additional decrease the barrier to entry for cybercriminals, enabling them to mount refined, multi-platform assaults at scale with out a lot effort or technical experience.
ClickFix Turns into Stealthy by way of Cache Smuggling
The findings additionally observe the invention of a brand new marketing campaign that has innovated on the ClickFix assault components by using a sneaky method known as cache smuggling to fly beneath the radar versus explicitly downloading any malicious information on the goal host.
“This marketing campaign differs from earlier ClickFix variants in that the malicious script doesn’t obtain any information or talk with the web,” Expel Principal Menace Researcher Marcus Hutchins stated. “That is achieved through the use of the browser’s cache to pre-emptively retailer arbitrary information onto the consumer’s machine.”
Within the assault documented by the cybersecurity firm, the ClickFix-themed web page masquerades as a Fortinet VPN Compliance Checker, utilizing FileFix techniques to deceive customers into launching the Home windows File Explorer and pasting a malicious command into the deal with bar to set off the execution of the payload.
The invisible command is designed to run a PowerShell script by way of conhost.exe. What makes the script stand aside is that it doesn’t obtain any extra malware or talk with an attacker-controlled server. As a substitute, it executes an obfuscated payload that passes off as a JPEG picture and is already cached by the browser when the consumer lands on the phishing web page.
“Neither the net web page nor the PowerShell script explicitly downloads any information,” Hutchins defined. “By merely letting the browser cache the faux ‘picture,’ the malware is ready to get a whole zip file onto the native system with out the PowerShell command needing to make any internet requests.”
“The implications of this method are regarding, as cache smuggling might provide a option to evade protections that might in any other case catch malicious information as they’re downloaded and executed. An innocuous-looking ‘picture/jpeg’ file is downloaded, solely to have its contents extracted after which executed by way of a PowerShell command hidden in a ClickFix phishing lure.”
