- Project WP2Shell — ClickFix via compromised WordPress
- Sector Multiple
- Date : 23 July, 2026
- Duration Active campaign
The dangerous WordPress isn’t yours. It’s your vendor’s.
Incident summary
| Element | Detail |
|---|---|
| Initial access | Vendor’s compromised WordPress site |
| Technique | ClickFix — fake reCAPTCHA with manual execution instructions |
| Payload | Obfuscated PowerShell chain with AMSI bypass and reflective loading |
| Outcome | Blocked by endpoint before execution completed |
| Detected by | Merabytes SOC Threat Hunting Team |
One of our clients received an infection attempt from the WordPress site of one of their own vendors. The site was compromised with WP2Shell and served a fake reCAPTCHA instructing the user to execute PowerShell manually. The attack surface you control is only part of the problem. The one your vendors control is the other part.
Customer identifiers and sensitive information have been redacted.
Initial access
The attack starts from an already compromised WordPress site. The visitor sees a fake reCAPTCHA screen instructing them to copy and execute a command to “verify they are human.”
The instructions are explicit:
- Press
Win + R - Paste the copied command
- Execute it
This is ClickFix. It works because the victim voluntarily executes the malware, bypassing email and browser protections designed to catch automatic downloads.
What we observed
Merabytes detected a PowerShell execution chain with multiple high-confidence indicators:
- Obfuscated PowerShell execution
- High-entropy Base64-encoded payloads
- AMSI bypass attempts
- Indirect command execution
- Native Windows API usage
- Chained LOLBins
- Direct syscall techniques
- Reflective shellcode loading
The endpoint terminated execution before the malware completed.
Why this matters for threat hunters
The PowerShell payload changes between campaigns. The infrastructure and behavioral patterns don’t.
1. High-entropy URLs
Download URLs contain randomized path components with unusually high entropy that stand out from legitimate WordPress traffic:
- Alphanumeric directories with no semantic meaning
- Encoded identifiers
- Multiple nested folders
Valid signal for NDR, proxies, web gateways, and SIEM correlation.
2. Command-line patterns
Campaigns include unusual characters in PowerShell command lines:
^ # character escaping
` # excessive backticks
-enc # Base64 payload
-nop # no profile
-w hidden # hidden window
None of these indicators are conclusive alone. Together, they form a strong hunting signal.
3. WordPress as initial infrastructure
Instead of newly registered domains, attackers reuse vulnerable WordPress sites or compromised shared hosting. In this case the exploited vulnerability affects versions 6.9.0–7.0.1 — not forgotten legacy sites, but recent, actively maintained installations.
Traffic blends into otherwise legitimate web activity, making reputation-based detection ineffective.
4. Referer-gated delivery — Google traffic only
The compromised site didn’t serve the fake reCAPTCHA to everyone. It only showed it to visitors arriving with a Google Referer header.
The implications are direct:
- The site owner or webmaster accessing directly sees the legitimate content — nothing looks wrong
- Manual audits and scanners without Google Referer context miss the infection entirely
- The payload only reaches real victims with active search intent
One additional detail: after compromising the site, the attacker patched the vulnerability used to get in. No external access to the entry vector means other actors can’t reuse it — the attacker protects their own infrastructure.
For threat hunters, this shifts the detection focus: web server logs are the primary source. Hunt for anomalous HTTP responses conditioned on the Referer: https://www.google.com/ header on paths that shouldn’t behave differently based on origin.
Detection opportunities
Recommended hunting targets:
| Signal | Context |
|---|---|
| PowerShell launched from Explorer after browser activity | ClickFix execution |
| Win+R followed by PowerShell | Manual execution |
PowerShell with -enc |
Encoded payload |
| High-entropy HTTP paths | Payload download |
| WordPress domains serving executable content | Compromised infrastructure |
Metacharacters like ^ in command lines |
Obfuscation |
Combining endpoint telemetry with network metadata significantly improves detection quality.
Recommendations
Technology alone is not enough. ClickFix exploits people, not systems.
- Realistic security awareness training — teach employees to recognize ClickFix attacks: no legitimate site asks you to run commands in the terminal to verify your identity.
- Behavioral EDR — signatures don’t catch these chains. Detection needs to be behavior-based.
- NDR with URL entropy analysis — high-entropy randomized paths are a detectable signal before the payload arrives.
- Continuous threat hunting — correlate endpoint telemetry with network traffic. The patterns in this campaign are reproducible.
Conclusion
ClickFix campaigns keep evolving. The underlying techniques stay detectable. When attackers use compromised WordPress sites as initial infrastructure, proactive hunting delivers more value than signature-based detection.
At Merabytes SOC, we turn real-world incidents into new detections before they become tomorrow’s breach.
#threathunting #clickfix #wordpress #powershell #malware #soc #edr #ndr #merabytes
Does your team have threat hunting capability? At Merabytes, we do it for you. merabytes.com
Frequently asked questions
An Adversary-Aware SOC goes beyond traditional security monitoring by understanding attacker tactics, techniques, and procedures (TTPs). We proactively hunt for threats using MITRE ATT&CK framework, behavioral analysis, and threat intelligence to detect attacks that bypass conventional security controls.
Traditional security tools focus on known signatures and indicators. Our behavioral detection analyzes anomalies in user activity, email patterns, network traffic, and system behavior to identify sophisticated attacks that use legitimate tools or bypass authentication controls. This caught the attacks in these case studies before significant damage occurred.
Our SOC operates 24/7 with real-time monitoring and automated response capabilities. Critical alerts trigger immediate investigation and containment actions within minutes. We provide continuous threat hunting, forensic analysis, and coordinated incident response to minimize impact and prevent lateral movement.
We combine global threat intelligence feeds with our own research from real incidents. Every attack we analyze contributes to our detection rules and IOC database, which is immediately shared across all protected environments. This means if we see a new attack pattern targeting one client, all clients are automatically protected within hours.
Absolutely. Our SOC integrates with your existing EDR, XDR, SIEM, firewalls, email security, and identity protection tools. We enhance their effectiveness by correlating events across all sources, applying adversary-aware detection logic, and providing expert human analysis that automated tools alone cannot achieve.