Hundreds of WordPress Sites Hijacked to Show Fake reCAPTCHA and Steal Windows Passwords.

Hundreds of compromised WordPress websites are being used in a sophisticated malware-delivery campaign that combines browser persistence, blockchain-hosted payloads, fake reCAPTCHA prompts and fileless execution to deploy the Amatera information stealer on Windows systems.

The campaign stands out for placing its malicious logic across nine layers designed to minimize durable evidence: no conventional payload server, few useful files to hash, and a browser-resident persistence mechanism that can outlive site-side cleanup.

The initial compromise begins with a malicious plugin that injects front-probe.js and registers a Service Worker named nochain-sw.js. Service Workers are browser components intended to support offline content and request handling.

However, in this case the code intercepts HTML responses, removes Content-Security-Policy headers and injects attacker-controlled JavaScript into pages viewed by visitors.

It activates immediately with skipWaiting() and clients.claim(), enabling it to control browsing sessions without waiting for a new browser session.

The Service Worker deliberately avoids WordPress administrators. It skips requests involving /wp-admin, /wp-login.php, the wordpress_logged_in_ cookie, or an operator-controlled nc_skip=1 cookie.

That selective filtering means ordinary logged-out visitors see the fake verification prompt while the site owner the person most likely to identify the compromise does not.

The injected JavaScript connects to the Base blockchain and queries smart contract 0x58460d0b3d4d6b03761c89120393c0c676676496.

Instead of hosting its next-stage code directly on a hijacked website or disposable server, the operator stores payload content in contract data and retrieves it through read-only RPC calls.

This tactic, known as EtherHiding, lets attackers update downstream instructions without changing the compromised site and complicates takedown efforts because defenders cannot simply seize or sinkhole an on-chain smart contract.

Independent analysis observed the same Base contract serving a NoChain fake-verification framework and ClickFix-style content.

The contract returns HTML for a counterfeit Google reCAPTCHA overlay. When a Windows user clicks the verification box, the page copies mshta http://timelevel12[.]com/big to the clipboard and instructs the victim to press Win+R, paste the command and execute it.

This social-engineering technique, widely tracked as ClickFix, turns the victim into the execution mechanism and can bypass security controls that depend on identifying malicious downloads or attachments before they are launched.

Netskope Threat Labs tracked the activity to rogue WordPress must-use plugins named site-helper-<hex>, which load automatically with the affected sites.

Microsoft has warned that ClickFix and TerminalFix campaigns increasingly abuse Windows utilities including mshta, PowerShell, cmd, WMI and scheduled tasks.

WordPress Sites Hijacked

The command retrieves a polyglot file that appears to be an MP3 but embeds an HTA application. Windows’ legitimate mshta.exe utility processes the HTA content, which creates a hidden scheduled task and launches an encoded PowerShell command.

The next stage reportedly bypasses Constrained Language Mode, tampers with AMSI scanning and executes subsequent content in memory rather than writing it to disk.

The campaign then fetches the Emmenhtal loader from gpuh.gravityzone[.]army, an infrastructure domain masquerading as Bitdefender GravityZone.

Emmenhtal extracts an encrypted payload hidden within an image hosted through a legitimate image CDN, then reflectively loads the final PE into memory.

The endpoint payload is Amatera, also known as ACR Stealer or AcridRain, a Windows credential stealer that targets browser credentials and other sensitive system information.

Other recent research has likewise linked ClickFix chains and blockchain-resolved scripts to Amatera distribution.

Amatera’s command-and-control activity reportedly uses encrypted DNS-over-HTTPS resolution alongside TLS, reducing visibility for network defenders.

The malware also communicates with gw.proxyvector[.]cc and may install a root certificate, making affected systems a potential source of credential theft and follow-on intrusion.

Organizations should investigate exposure to site-helper-<hex> plugins, nochain-sw.js, the Base contract address, timelevel12[.]com, gpuh.gravityzone[.]army, i.ibb[.]co/3ytBLkY6/init-block.jpg, ultraspeed[.]pro/collect, and gw.proxyvector[.]cc.

The related Service Worker and contract have also been independently observed in active compromised-site infrastructure.

For WordPress administrators, remediation must include removing rogue plugins, reviewing modified JavaScript, rotating credentials and auditing all administrator accounts.

Crucially, site cleanup alone may not protect visitors who already registered the malicious Service Worker; users should clear site data and unregister Service Workers for affected domains.

Defenders should treat any CAPTCHA, browser warning or verification page that asks users to paste a command into Run, Terminal, PowerShell or Command Prompt as malicious.

Blocking mshta.exe where operationally feasible, restricting PowerShell, enabling script-block logging, monitoring scheduled-task creation and inspecting unexpected blockchain RPC traffic can interrupt the chain before Amatera reaches memory.

IOCs

Indicator	Type	Notes
0x58460d0b3d4d6b03761c89120393c0c676676496	EVM contract (Base 8453)	Mutable payload/script registry and C2
ultraspeed[.]pro	Domain	Encrypted telemetry beacon host
https://ultraspeed[.]pro/collect	URL	ECDH P-256 + AES-GCM encrypted telemetry endpoint
timelevel12[.]com	Domain	Stage-2 MP3/HTA polyglot host
http://timelevel12[.]com/big	URL	Stage-2 payload fetched via mshta paste-and-run

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide