Hundreds of WordPress sites have been hijacked in a stealthy campaign that ultimately delivers the Amatera password stealer using a novel “ClickFix” chain. Researchers discovered compromised must-use plugins that inject scripts into visitors’ browsers, strip critical security headers, and trigger fake CAPTCHA prompts—all leading to instructions for Windows users to execute malicious commands. The targets appear to be Windows systems, where the chain ends in installing Amatera (formerly known as ACR Stealer).
How the Attack Chain Unfolds
The attack begins with the compromise of legitimate WordPress sites, where a rogue must-use plugin—named using randomized hex—registers a Service Worker. That Service Worker strips out the site’s Content-Security-Policy (CSP) header and injects a script that loads payloads from a smart contract on the Base blockchain. The next stage presents victims with a fake reCAPTCHA prompt, tricking Windows users into copying a command to their clipboard and pasting it into the “Run” dialog. Similar steps for other platforms serve up benign decoys to avoid detection.
Once the command fires, it launches a sequence involving an HTML Application (HTA) or MP3-HTA polyglot, a fileless PowerShell stage where AMSI (Windows’ Anti-Malware Scan Interface) is disabled, and a stealthy loader that never writes the payload to disk. Finally, Amatera Stealer—masquerading as a legitimate tool named WPA.exe and disguised with metadata to appear trustworthy—is installed. The stealer is confirmed via multiple antivirus engines. It exfiltrates browser credentials, system data, crypto wallets, and more, communicating with control servers through encrypted channels and via DNS-over-HTTPS to hide its tracks.
Why This Campaign is Different
This operation is notable for its layered, defense-aware architecture. Each stage is designed to bypass a different security control. For instance, stripping CSP enables script injection even if the site is cleaned; fileless stages and reflective loaders evade endpoint detection; and using blockchain smart contracts for payload delivery makes command-and-control (C2) infrastructure harder to locate and disrupt.
Another twist: Windows systems are the primary focus, and only certain users see the trigger steps. Visitors who are logged into WordPress, or accessing admin pages, or carrying a skip-cookie are bypassed by the injected scripts—leaving the threat dormant from view for those who could otherwise detect it.
Once Amatera is seeded, it can install a root certificate and communicate with C2 servers pretending to be legitimate, using TLS and other evasion techniques. It not only steals credentials and sensitive files but also installs infrastructure that aids stealthy persistence.
What to Look Out For and How to Defend
Defenders should monitor for several red flags: fake CAPTCHA prompts, instructions to open Run or PowerShell dialogs copied from web pages; unusual use of trusted Windows tools like mshta.exe, rundll32.exe, or even scheduled tasks invoked from browser-driven contexts. Also, Service Worker scripts named like nochain-sw.js, unusual smart contract interactions, and hidden payloads delivered via image-based or polyglot files.
Hardening includes forcing visible file extensions in Windows, blocking executable content from archives unexpectedly, enabling threat detection on credential stores and remote access tools, and conducting threat hunting using the available indicators of compromise (IoCs).
No credible attribution yet has been made public for who is orchestrating these specific campaigns. While many of the techniques and tools (e.g. fake CAPTCHAs, AMSI bypass, WordPress compromises) have been observed across multiple actors, the accumulation of evidence points to a high level of craft rather than opportunistic crime.
Your institution’s website or its visitors could already be entangled. Security teams need to act quickly—not just patching, but auditing front-end user flows and web infrastructure.
Why this matters: It’s a striking new evolution in infostealer delivery. Rather than exploiting a code flaw, this pivot puts the burden on user interaction—plus chain-melting techniques to dodge detection. If more credible brands or high-traffic sites fall victim, the scale could be huge. Watch for reports tying Amatera/ACR activity to compromised cloud services, and similarly stealthy use of blockchain-based C2 loops.
