Compromised WordPress Sites Deliver ClickFix Attacks in Global Infostealer Campaign

Rapid7 warns of a global cyber-criminal campaign that has compromised 250+ legitimate WordPress sites in at least 12 countries and uses convincing fake Cloudflare captcha pages plus ClickFix social-engineering prompts to trick visitors into running commands that install infostealer malware (Vidar, Impure, Vodka, Double Donut) to harvest credentials and financial data; site compromises may stem from plugin/theme vulnerabilities, stolen credentials, or brute-force admin access, and Rapid7 advises patching, strong passwords, MFA and avoiding running untrusted code.