Nearly 2,000 hacked WordPress websites were used to distribute malware, steal data, monitor victims, and deploy ransomware, according to cybersecurity firm Check Point Research.
Myriad: Who wins BLAST Open Porto 2026? Click to make your prediction.“The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together,” Check Point researcher Jaromír Horejsi wrote. “Some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims.”
The report did not say whether macOS and Linux users are affected.
However, mistakes by the attackers gave Check Point researchers a deeper look inside the operation, the company said.
“Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims’ machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites,” Horejsi wrote.
By July 24, the campaign had compromised more than 6,000 unique IP addresses, including 1,852 in the United States and 630 each in Russia and India.
Exposed directories contained infection logs and screenshots from victims' computers. Researchers said they were able to collect over 31,000 screenshots between mid-May and the end of July, along with more than 700 archives containing stolen data, including documents, passwords, and cryptocurrency wallet files.
Check Point believes the threat actor also accidentally infected themselves.
“We collected a few hundred files exfiltrated from victims’ machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content,” Horejsi wrote. “This also helps us better understand how the actor operates and how many compromised domains they likely control.”
ClickFix has surfaced in several other malware campaigns this year.
