Hundreds of compromised WordPress websites are reportedly being used to display fake reCAPTCHA checks and deliver malware to Windows visitors. The campaign combines malicious plugins, browser persistence, blockchain-hosted instructions and “ClickFix” social engineering to install Amatera, an information stealer designed to capture browser passwords and other sensitive data.
Key takeaways
- Fake CAPTCHA pages instruct visitors to paste commands into Windows Run.
- A malicious Service Worker can continue affecting visitors after site cleanup.
- The Amatera stealer targets browser credentials and system information.
- WordPress owners should treat unexpected plugins and scripts as urgent warning signs.
How the WordPress campaign works
The attack reportedly begins with a rogue must-use plugin, often named in the format site-helper-<hex>. It injects JavaScript and registers a Service Worker called nochain-sw.js. Unlike a normal website script, this browser component can intercept page responses, remove security headers and inject content into future visits.
The Service Worker is designed to avoid WordPress login and administration pages. As a result, logged-out visitors may see the fraudulent prompt while site owners remain unaware that their website has been altered. Its browser-based persistence also means removing the original plugin may not immediately protect returning visitors.
Blockchain helps hide the next stage
Rather than storing all instructions on the compromised websites, the injected script queries a smart contract on the Base blockchain. This technique, known as EtherHiding, allows attackers to retrieve or change payload instructions through blockchain data, making conventional server takedowns less effective.
The contract reportedly supplies a counterfeit Google reCAPTCHA overlay. After a visitor clicks the verification box, the page uses a ClickFix-style trick: it places a Windows command in the clipboard and tells the user to open Run, paste it and execute it. Genuine CAPTCHA checks do not require users to run commands on their computers.
Fileless malware targets Windows passwords
The command fetches a file disguised as an MP3 but containing an HTA application. Windows’ legitimate mshta.exe utility processes it, creating a hidden scheduled task and launching encoded PowerShell. Further stages reportedly interfere with security scanning and run in memory to reduce the number of files investigators can recover.
The chain then loads Emmenhtal, which extracts an encrypted payload hidden in an image before loading Amatera—also known as ACR Stealer or AcridRain. The malware is associated with theft of browser passwords and other valuable system information, with encrypted communications intended to make detection more difficult.
What WordPress owners should do
A reliable WordPress maintenance plan can help identify unusual changes before they affect visitors. Site owners should:
- Inspect must-use plugins, recently changed JavaScript and unfamiliar Service Workers.
- Remove unauthorised code, rotate WordPress and hosting credentials, and review administrator accounts.
- Check scheduled tasks and endpoint alerts for unexpected
mshta.exeor PowerShell activity. - Ask affected visitors to clear site data and unregister Service Workers for the domain.
A WordPress care plan should include monitoring, backups, updates and security reviews—not just occasional cleaning after an incident. Any verification page asking visitors to paste commands into Run, PowerShell, Command Prompt or Terminal should be treated as malicious.