Artlist ClickFix Campaign Uses Infostealer-Stolen WordPress Credentials to Deploy RAT Malware

A threat campaign discovered in mid-July 2026 abused the compromised Artlist subdomain new-blog. artlist[.]io to distribute a Remote Access Trojan through a fake CAPTCHA prompt.

The operation combined stolen WordPress credentials, blockchain-based EtherHiding infrastructure, ClickFix social engineering, DLL side-loading, and a Tor-backed command-and-control fallback.

The incident affected a high-value web property. Similarweb data indicates that Artlist’s primary domain receives more than 111111 million monthly visits, allowing attackers to abuse the reputation of a widely trusted digital-asset platform to evade conventional URL filtering and user suspicion.

Hudson Rock traced the initial access path to an infostealer infection dating back to August 2023. An Israeli freelance WordPress full-stack developer allegedly downloaded a pirated copy of Adobe Acrobat Pro DC through uTorrent.

The downloaded software infected the developer’s device with an infostealer that harvested browser-stored passwords, cookies, and active session tokens.

Among the recovered data were credentials for new-blog.artlist[.]io/blog/wp-login.php, reportedly belonging to a former senior Artlist content executive.

The developer had likely retained the privileged credentials following work or collaboration with the company. Although the password was described as strong, it was ineffective once copied by infostealer malware from the endpoint.

Using the valid WordPress account, the operators accessed the blog backend and inserted malicious JavaScript into HTML templates. The injected code did not directly contain a fixed payload URL.

Instead, it used EtherHiding, a technique in which malware queries a blockchain smart contract to retrieve its next-stage infrastructure dynamically.

In this case, the loader contacted a Polygon RPC endpoint and performed an eth_call against a designated smart contract. The contract returned the address of a downstream payload server, identified as auth-code-check[.]info.

In mid-July 2026, Hudson Rock researchers discovered a sophisticated ClickFix campaign operating on a subdomain belonging to the popular digital asset platform, Artlist.

This architecture lets attackers rotate malicious infrastructure by updating blockchain-hosted data rather than repeatedly modifying the compromised WordPress site.

Artlist ClickFix Campaign

The next-stage code presented visitors with a full-screen fake reCAPTCHA verification overlay. The ClickFix lure instructed targets to press Windows +++ X, then I, Ctrl +++ V, and Enter.

These steps opened Windows Terminal and executed a PowerShell command silently copied to the victim’s clipboard.

That command downloaded a password-protected archive named fdupdate.zip, extracted it with a bundled copy of 777-Zip, and launched fdupdate.exe, a legitimate signed binary associated with StruSoft FEM-Design.

The attackers then used the trusted executable to side-load malicious DLLs, beginning with LibBind.dll.

The malware chain used multiple layers of encrypted payloads and in-memory execution. LibBind.dll decrypted data from Stream.Toolkit.dat and invoked shellcode through the EnumTimeFormatsEx callback mechanism, avoiding more closely monitored thread-creation APIs.

The shellcode extracted a Delphi loader, act.exe, from Face.dat; the loader subsequently unpacked and manually mapped the final x64x64x64 RAT payload.

According to technical analysis by researcher Matt Kirkland, the RAT uses a custom framed protocol and hybrid RSA/AES encryption for command-and-control communications.

If its primary C2 infrastructure becomes unavailable, the malware can load a Tor component in memory and contact hardcoded .onion endpoints through a local SOCKS proxy.

The final payload supports credential theft, cookie and token collection, keylogging, screen streaming, resumable file transfer, hidden-desktop interaction, and SOCKS proxying. These capabilities enable both immediate data theft and follow-on intrusion activity.

The case reinforces a growing threat pattern: infostealer logs turn past endpoint infections into long-term corporate access opportunities.

Organizations should revoke and rotate credentials exposed through third-party devices, enforce phishing-resistant MFA for CMS administration, monitor WordPress template changes, and block known ClickFix, infostealer, and malicious blockchain-RPC activity at the network perimeter.

IOCs

Indicator	Indicator Type
new-blog.artlist[.]io	Compromised Host / Domain
auth-code-check[.]info	Delivery Domain
0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2	Polygon EtherHiding Smart Contract Address
45.151.74[.]119:443	Command-and-Control C2C2C2 IP Address and Port
109.172.95[.]184:443	Command-and-Control C2C2C2 IP Address and Port
151.236.4[.]135:443	Command-and-Control C2C2C2 IP Address and Port
62.60.156[.]11:443	Command-and-Control C2C2C2 IP Address and Port

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide