Press play to start listening
A new wave of ClickFix social engineering attacks has been uncovered, adding to an already long list of campaigns using the widespread trick to compromise Windows computers with infostealers.
Cybersecurity researchers at Sophos’ Counter Threat Unit (CTU) tracked the latest activity to June 3 and 4, 2026, identifying more than 500 compromised WordPress websites injected with malicious JavaScript and serving fake Cloudflare security prompts.
According to researchers, attackers use the fake verification process to trick visitors into copying and executing malicious commands under the guise of completing a routine human verification check.
How Scammers Abuse Legitimate Software
The attack chain begins when a visitor lands on a compromised website. The page displays a fake Cloudflare verification prompt that instructs the user to copy a command and run it through Windows Terminal.
Executing the command triggers an MSI-based staging chain. According to Sophos, the MSI executes additional scripts, including november85.cmd and Griffin20.ps1, which ultimately use the native Windows package manager winget.exe to download and install Deno v2.3.
Deno is a legitimate JavaScript runtime with digitally signed distributions. Security researcher John Hammond Taggart had previously highlighted the potential for attackers to abuse Deno because it can execute code while benefiting from the trust associated with a legitimate developer utility. Sophos noted that Deno’s signed binaries can reduce the likelihood of security controls flagging the executable.
The malicious WordPress injections communicated with attacker-controlled infrastructure, with columbnezhjdq.com hosting the first-stage loader and webstizkgao.com hosting the second-stage JavaScript executed through Deno. The Deno execution chain subsequently delivers a Python-based infostealer called install.pyc, which Sophos found was retrieved from 162.33.177.16 and executed through pythonw.exe.
Once active, the infostealer collects a range of sensitive information from the infected computer, including system information, browser and browser-extension data, cryptocurrency wallet information, and recorded keystrokes.
Why ClickFix is a Growing Security Threat
The activity highlights a broader trend seen throughout 2026 in which attackers manipulate users into executing malicious commands themselves instead of relying exclusively on software vulnerabilities.
So far this year, Hackread.com has reported several ClickFix incidents, including campaigns using fake CAPTCHAs and variants impersonating services and applications such as Google Meet, Microsoft Word, and GitHub. Some campaigns have also abused native Windows utilities such as cmdkey and regsvr32.
More recently, researchers at Malwarebytes and Kaspersky have tracked ClickFix-related activity involving malware families including StealC, Remus, NetSupport, and OkoBot across multiple countries.
ClickFix works by turning the victim into part of the execution chain, convincing users to run malicious commands themselves because they believe the instructions are part of a legitimate verification process.
The danger is increased when attackers combine this social engineering technique with trusted, built-in Windows utilities and legitimate, digitally signed software. In this case, the abuse of Deno can make parts of the intrusion chain less likely to be immediately flagged by security controls, while allowing attacker-supplied code to execute on the compromised system.
Attackers Update Their Infrastructure
Sophos analysts noted in a blog post shared with Hackread.com that the attackers continued modifying their infrastructure after the campaign was initially observed.
On June 23, 2026, the attackers updated their remote JavaScript to use a staging URL hosted on Cloudflare’s free TryCloudflare service. The script downloaded content from that URL and stored it in a Windows Registry key disguised as a Microsoft Edge update.
WordPress Sites Face Ongoing Security Threats
The campaign also comes amid heightened security concerns for WordPress websites. As Hackread.com recently reported, a separate vulnerability dubbed XSS2Shell (CVE-2026-64638) affected WordPress Core and could potentially allow an attacker to progress from cross-site scripting (XSS) to remote code execution (RCE) under specific conditions involving an authenticated administrator.
The flaw, which researchers estimated had exposed more than 500 million websites before fixes became available, was patched in WordPress 7.0.3 and corrected maintenance releases for older branches. There is no indication that XSS2Shell was used to compromise the WordPress sites involved in the ClickFix campaign.
Staying Protected
Sophos recommends that organizations monitor and restrict unauthorized use of Deno, review instances where deno.exe is executed from user-writable directories, investigate Deno-related persistence mechanisms, and block malicious domains and IP addresses associated with the campaign.
For individual users, the most important warning sign is a website asking visitors to copy and execute PowerShell, Windows Terminal, Command Prompt, or other command-line instructions as part of a CAPTCHA or security verification process.
Users should treat such instructions as highly suspicious and avoid executing commands copied from unexpected website pop-ups. Legitimate-looking verification pages can be part of ClickFix attacks designed specifically to convince victims to execute the infosteamer chain themselves.
