The CAPTCHA Trap: How a Global ‘ClickFix’ Campaign Weaponizes WordPress to Drain Digital Wallets

Rapid7 researchers uncovered a widespread campaign that compromises over 250 legitimate WordPress sites in at least 12 countries to inject a fake Cloudflare CAPTCHA (ClickFix) which tricks visitors into running a Win+R/PowerShell command. That command loads an in-memory DoubleDonut loader delivering a rotating set of infostealers—including Vidar Stealer v2, Impure Stealer, and a custom VodkaStealer—that exfiltrate credentials and drain digital wallets while employing strong anti-analysis and geofencing checks.