ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure

### Executive summary: The Australian Signals Directorate's ACSC reports an active ClickFix campaign using compromised WordPress sites to display fake verification prompts that copy obfuscated PowerShell commands to victims' clipboards; when executed, these commands download and run the Vidar Stealer infostealer to exfiltrate credentials, browser data and wallets. The advisory details observed TTPs (including PowerShell execution, user-driven copy/paste execution, file self-deletion, HTTP/S C2 via dead-drop resolvers), maps them to MITRE ATT&CK, provides IOCs and detection IDs, and recommends mitigations such as application control, patching, MFA, PowerShell restrictions, DLP and security awareness training.