- Threat researchers at Rapid7 uncovered a global campaign that compromised over 250 legitimate websites, including a Harvard blog and a US Senate candidate’s official webpage, to spread infostealer malware.
- Attackers use a manipulative Cloudflare Captcha fake page to trick visitors into running malicious code directly on their own devices.
- The campaign has been active since December 2025, targets users across 12 countries, and deploys multiple infostealers designed to harvest passwords, crypto wallets, and sensitive personal data.
Cybercriminals have weaponised trusted websites to turn everyday browsing into a security threat. Threat researchers at Rapid7 uncovered a large-scale campaign that quietly hijacked over 250 legitimate websites, including blog pages on Harvard’s International Review platform, to deliver dangerous infostealer malware to unsuspecting visitors.
The operation stretches across up to 12 jurisdictions: Brazil, Australia, Czechia, Canada, Germany, Israel, India, Slovakia, Singapore, the United Kingdom, Switzerland, and the United States. Among the compromised sites are regional news publications, local business websites, and the official webpage of a US Senate candidate.
Over 250 Sites Hijacked in a Long-Running Global Operation
Rapid7 researchers confirmed the campaign has been active since December 2025. The attackers focused specifically on WordPress-based websites, exploiting the trust that everyday users place in credible or familiar online platforms.
According to Rapid7, the inappropriate application of legitimate platforms is why this threat is particularly dangerous for both organisations and individual users. Visitors land on a site they recognise, with no visible sign that anything has gone wrong.
The sheer scale of the operation signals a high level of organisation. According to Rapid7 researchers, the compromise of so many completely unrelated WordPress websites strongly points to heavy automation on the part of the threat actors, and suggests this is part of a coordinated, long-running criminal effort rather than a set of isolated incidents.
Rapid7 has not pinpointed exactly how attackers gained access to each site. Researchers suggest the most likely entry points include unpatched WordPress plugin or theme vulnerabilities, the reuse of previously stolen admin credentials, or brute-force attacks against exposed login portals.
The Fake Captcha Tricking Users Into Infecting Their Own Devices
Visitors to compromised sites do not see anything alarming at first. The attackers present something instantly recognisable instead: a Cloudflare Captcha verification page. Familiarity is the whole point. Most users have encountered this type of page across dozens of legitimate websites, which makes it an effective disguise.
The page is entirely fake. It runs on ClickFix, a social engineering technique that uses fraudulent dialogue boxes and verification prompts to manipulate users into executing malicious commands themselves. The fake Captcha instructs the visitor to open the Windows Run command box and paste in a provided command, framing it as a necessary verification step. The moment the user complies, the command silently triggers a multi-stage process that downloads and installs malware on the device.
Researchers observed several infostealer payloads distributed through the compromised sites. These include Impure Stealer, Vidar Stealer, Double Donut, and Vodka Stealer, with the last one frequently appearing in ClickFix-style attacks. Each payload chases the same outcome: extract everything of value from the infected machine.
Researchers also found a hidden malicious script embedded inside the compromised pages. The script contained a reversed remote URL, a common obfuscation trick attackers use to keep their infrastructure hidden from security scanning tools.
What Attackers Steal and What Site Owners Must Do Now
The data these infostealers target includes usernames, passwords, digital wallet credentials, authentication tokens, and other sensitive personal information. Attackers either use this data directly for financial fraud or sell it to other criminals on underground marketplaces. Either way, the stolen credentials frequently power further, more targeted attacks against individuals and organisations.
Data theft is also a primary goal of espionage operations. Iran-linked hackers used Chaos ransomware to hide their true objective of stealing sensitive information, showing that data theft spans both financial and state-sponsored cybercrime.
Rapid7 has already notified US authorities about the compromised Senate candidate webpage. Harvard’s International Review blog hosted at least two of the confirmed infected pages.
For WordPress administrators, Rapid7 recommends keeping all plugins, themes, and core software updated at all times, alongside running regular vulnerability scans. Administrators should use long, complex passwords managed through a dedicated password manager, and enable two-factor authentication on all admin accounts. Running untrusted code on any device that stores saved browser credentials linked to site management is something administrators should avoid entirely.
For everyday users, the warning is direct. No legitimate website will ever ask you to open your Run command and paste something into it. If a site makes that request, it is a trap. Close the tab immediately.
