Cybersecurity researchers are calling consideration to a nefarious marketing campaign focusing on WordPress websites to make malicious JavaScript injections which can be designed to redirect customers to sketchy websites.
“Website guests get injected content material that was drive-by malware like pretend Cloudflare verification,” Sucuri researcher Puja Srivastava stated in an evaluation revealed final week.
The web site safety firm stated it started an investigation after one in all its buyer’s WordPress websites served suspicious third-party JavaScript to web site guests, finally discovering that the attackers launched malicious modifications to a theme-related file (“features.php”).
The code inserted into “features.php” incorporates references to Google Adverts, possible in an try and evade detection. However, in actuality, it features as a distant loader by sending an HTTP POST request to the area “brazilc[.]com,” which, in flip, responds with a dynamic payload that features two elements –
- A JavaScript file hosted on a distant server (“porsasystem[.]com”), which, as of writing, has been referenced on 17 web sites and incorporates code to carry out web site redirects
- A chunk of JavaScript code that creates a hidden, 1×1 pixel iframe, inside which it injects code that mimics professional Cloudflare belongings like “cdn-cgi/challenge-platform/scripts/jsd/primary.js” – an API that is a core a part of its bot detection and problem platform
It is value noting that the area “porsasystem[.]com” has been flagged as half of a visitors distribution system (TDS) known as Kongtuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124).
Based on info shared by an account named “monitorsg” on Mastodon on September 19, 2025, the an infection chain begins with customers visiting a compromised web site, ensuing within the execution of “porsasystem[.]com/6m9x.js,” which then results in “porsasystem[.]com/js.php” to finally take the victims to ClickFix-style pages for malware distribution.
The findings illustrate the necessity for securing WordPress websites and guaranteeing that plugins, themes, and web site software program are stored up-to-date, implementing sturdy passwords, scanning the websites for anomalies and sudden administrator accounts created for sustaining persistent entry even after the malware is detected and eliminated.
Create ClickFix Pages Utilizing IUAM ClickFix Generator
The disclosure comes as Palo Alto Networks Unit 42 detailed a phishing equipment named IUAM ClickFix Generator that enables attackers to contaminate customers with malware by leveraging the ClickFix social engineering method and provide you with customizable touchdown pages by mimicking browser verification challenges typically used to dam automated visitors.
“This instrument permits menace actors to create extremely customizable phishing pages that mimic the challenge-response conduct of a browser verification web page generally deployed by Content material Supply Networks (CDNs) and cloud safety suppliers to defend towards automated threats,” safety researcher Amer Elsad stated. “The spoofed interface is designed to look professional to victims, growing the effectiveness of the lure.”
The bespoke phishing pages additionally include capabilities to govern the clipboard, a vital step within the ClickFix assault, in addition to detect the working system used with the intention to tailor the an infection sequence and serve suitable malware.
In at the very least two completely different instances, menace actors have been detected utilizing pages generated utilizing the equipment to deploy info stealers similar to DeerStealer and Odyssey Stealer, the latter of which is designed to focus on Apple macOS programs.
The emergence of the IUAM ClickFix Generator provides to a previous alert from Microsoft warning of an increase in industrial ClickFix builders on underground boards since late 2024. One other notable instance of a phishing equipment that has built-in the providing is Impression Options.
“The kits supply creation of touchdown pages with a wide range of accessible lures, together with Cloudflare,” Microsoft famous again in August 2025. “Additionally they supply building of malicious instructions that customers will paste into the Home windows Run dialog. These kits declare to ensure antivirus and internet safety bypass (some even promise that they will bypass Microsoft Defender SmartScreen), in addition to payload persistence.”
It goes with out saying that these instruments additional decrease the barrier to entry for cybercriminals, enabling them to mount subtle, multi-platform assaults at scale with out a lot effort or technical experience.
ClickFix Turns into Stealthy through Cache Smuggling
The findings additionally comply with the invention of a brand new marketing campaign that has innovated on the ClickFix assault method by using a sneaky method known as cache smuggling to fly underneath the radar versus explicitly downloading any malicious information on the goal host.
“This marketing campaign differs from earlier ClickFix variants in that the malicious script doesn’t obtain any information or talk with the web,” Expel Principal Menace Researcher Marcus Hutchins stated. “That is achieved by utilizing the browser’s cache to pre-emptively retailer arbitrary knowledge onto the person’s machine.”
Within the assault documented by the cybersecurity firm, the ClickFix-themed web page masquerades as a Fortinet VPN Compliance Checker, utilizing FileFix techniques to deceive customers into launching the Home windows File Explorer and pasting a malicious command into the handle bar to set off the execution of the payload.
The invisible command is designed to run a PowerShell script through conhost.exe. What makes the script stand aside is that it doesn’t obtain any further malware or talk with an attacker-controlled server. As a substitute, it executes an obfuscated payload that passes off as a JPEG picture and is already cached by the browser when the person lands on the phishing web page.
“Neither the net web page nor the PowerShell script explicitly downloads any information,” Hutchins defined. “By merely letting the browser cache the pretend ‘picture,’ the malware is ready to get a whole zip file onto the native system with out the PowerShell command needing to make any internet requests.”
“The implications of this method are regarding, as cache smuggling might supply a technique to evade protections that may in any other case catch malicious information as they’re downloaded and executed. An innocuous-looking ‘picture/jpeg’ file is downloaded, solely to have its contents extracted after which executed through a PowerShell command hidden in a ClickFix phishing lure.”
