Description
WordPress websites are increasingly being targeted by threat actors who install malicious plugins that push information-stealing malware to unsuspecting visitors. These plugins display fake software updates and error messages to trick users into executing malicious scripts. Two significant campaigns, ClearFake and ClickFix, have been identified as the primary perpetrators, with over 6,000 WordPress sites reportedly compromised. These attacks are particularly alarming for website owners, as they exploit stolen credentials to inject harmful code into legitimate websites, affecting site visitors and posing a serious threat to both individual users and businesses.
Attack Details
The ClearFake campaign, which began in 2023, uses compromised websites to display fake web browser update banners. When unsuspecting users click on these banners, they unknowingly download and install information-stealing malware. This malware is designed to extract sensitive data from users, such as login credentials, which threat actors can use to further infiltrate networks and steal additional information. ClearFake exploits the trust users place in common browser update notifications, making it an effective method for distributing malware.
In 2024, a new, more sophisticated campaign called ClickFix emerged. Similar to ClearFake, ClickFix also aims to install information-stealing malware but does so under the guise of fake software error messages. These error messages claim to offer fixes but instead prompt users to execute malicious PowerShell scripts, which then download the malware. ClickFix has grown increasingly common, with fake error banners impersonating trusted applications like Google Chrome, Facebook, and Google Meet. The attackers have compromised thousands of WordPress sites by installing malicious plugins, which appear legitimate but hide harmful scripts. Examples of such plugins include LiteSpeed Cache Classic, Wordfence Security Classic, and SEO Booster Pro. These plugins inject JavaScript into the site’s HTML, which then loads additional malicious scripts from a Binance Smart Chain (BSC) smart contract, tricking users into downloading malware.
Remediation
If you suspect your WordPress site has been compromised by these attacks, immediate action is necessary to protect both your site and visitors.
The Guyana National CIRT recommends that users and administrators review this alert and apply it where necessary.
PDF Download: Malicious WordPress Plugins ClickFix and ClearFake Campaigns Compromise Thousands of Sites
References