Thousands of WordPress Sites Compromised as Hackers Deploy Cutting-Edge ClickFix Phishing Scams

A wave of cyberattacks has swept across the WordPress ecosystem, with thousands of sites falling prey to a sophisticated phishing campaign known as ClickFix. Hackers are leveraging stolen admin credentials and deceptive plugins to inject malicious code, pushing advanced information-stealing malware onto unsuspecting visitors via seemingly harmless prompts.

Key Takeaways

• Over 6,000 WordPress sites breached in latest ClickFix campaign.

• Attackers use stolen admin credentials to install fake plugins.

• Fake browser error and update prompts are used to convince users to execute malicious scripts.

• No known WordPress vulnerabilities exploited; attacks rely on compromised credentials.

• Next-gen tactics like cache smuggling and phishing kit automation are increasing the scale and stealth of infections.

How Hackers Gain Access and Plant Malicious Plugins

Rather than exploiting software bugs, attackers are primarily operating with stolen administrator usernames and passwords. With legitimate credentials, they can silently install malicious plugins and modify theme files without raising suspicion. These plugins mimic popular tools like Wordfence Security or LiteSpeed Cache and can be difficult to distinguish from genuine add-ons.

Common tactics include:

• Automated login using stolen admin credentials.

• Installation of fake plugins with generic names such as "Advanced User Manager" or "Quick Cache Cleaner.

• Injection of harmful JavaScript via core WordPress actions and theme files.

Deceptive Tactics Used to Lure Victims

Once injected, the malicious code displays fake software update banners, browser error messages, or security checks mimicking services like Cloudflare or Chrome. These overlays urge visitors to run supposed “fixes,” which typically involve copying and pasting PowerShell commands or downloading disguised files. In reality, these actions trigger the installation of info-stealing malware or remote access trojans.

A particularly dangerous variant, known as ClickFix, has evolved to use browser cache stores to hide malicious payloads, evading security solutions that scan for file downloads. The phishing pages and malware are highly customizable, even mimicking compliance tools for corporate VPNs.

ClickFix and Automation: Lowering the Barrier for Cybercriminals

Phishing kit generators are making it easier for attackers of all skill levels to launch complex campaigns at scale. Tools like IUAM ClickFix Generator can:

• Create fake browser verification and update pages with tailored malware delivery.

• Adjust infection sequences based on user operating system.

• Manipulate the clipboard and use cache-based payloads.

Security researchers warn that these kits can bypass some antivirus protections, furthering the reach and effectiveness of the attacks.

Protecting Your Website and Visitors

Given the widespread nature of these attacks and their reliance on compromised credentials rather than code vulnerabilities, website owners should take proactive steps:

1. Review installed plugins: Remove anything not intentionally installed.

2. Reset admin passwords: Use strong, unique passwords and enable multi-factor authentication.

3. Monitor for suspicious admin accounts: Immediately remove any unauthorized users.

4. Keep WordPress, themes, and plugins updated: Regular hygiene closes potential weak spots.

5. Deploy security monitoring: Scan for unauthorized changes, theme/file modifications, or unusual plugin additions.

As attackers get more creative and automation lowers technical barriers, vigilance and layered security remain essential to safeguarding both websites and their visitors. As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• Hackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks, The Hacker News.

• Over 6,000 WordPress sites hacked to install plugins pushing infostealers, BleepingComputer.

• Fake WordPress Plugins Prompt Users To Install Malware, The Cyber Express.