Hudson Rock Traces Artlist ClickFix Campaign to Stolen WordPress Credentials

Jul 14, 2026 · Original article ↗

Summary

Hudson Rock researchers report that stolen WordPress credentials enabled a ClickFix campaign on an Artlist subdomain. They detail EtherHiding via Polygon, a DLL-sideloading chain and an in-memory RAT; Artlist had not commented at publication.

Key points

Hudson Rock researchers report that attackers injected malicious code into Artlist’s compromised new-blog.artlist[.]io subdomain.
The researchers trace the reported access to an August 2023 infostealer infection on a freelance developer’s computer; saved privileged WordPress credentials were reportedly stolen.
A fake CAPTCHA used ClickFix to trick visitors into pasting a hidden PowerShell command. EtherHiding queried a Polygon smart contract to retrieve the next-stage payload server.
The command downloaded a password-protected ZIP and used a signed StruSoft updater to sideload malicious DLLs; the reported shellcode used EnumTimeFormatsEx for callback execution.
The researchers describe an in-memory RAT with encrypted C2, a Tor fallback, credential collection, keylogging, screen streaming, file transfers and SOCKS-bridge capabilities.
Hudson Rock said it contacted Artlist but had received no comment at publication.

Article Details

Attack Vectors: An infostealer infection on a freelance developer’s machine, reportedly caused by a pirated Adobe Acrobat PRO DC torrent, stole browser credentials, cookies, and session tokens.
Stolen privileged credentials were used to access Artlist’s compromised WordPress subdomain and inject malicious JavaScript into its HTML templates.
Injected JavaScript queried a Polygon smart contract to dynamically retrieve the payload server, then presented a fake CAPTCHA as a ClickFix lure.
The fake CAPTCHA instructed visitors to paste a hidden PowerShell command into Windows Terminal; the command downloaded and extracted a password-protected ZIP archive.
A signed updater executable was used to sideload unsigned DLLs, leading through an obfuscated, multi-stage chain to a RAT loaded into memory.
Defensive Notes: The article recommends monitoring active C2 infrastructure and blocking malicious communications at the network edge.
The article identifies infostealer-derived credentials as a route to privileged access and subsequent compromise of a trusted corporate website.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`auth-code-check[.]info`	Malicious delivery domain serving the ClickFix CAPTCHA payload.
HOSTNAME	`new-blog[.]artlist[.]io`	Compromised Artlist subdomain used to host the ClickFix lure and distribute the campaign.
IPV4	`109[.]172[.]95[.]184`	Listed as a direct C2 IP for the campaign’s RAT.
IPV4	`151[.]236[.]4[.]135`	Listed as a direct C2 IP for the campaign’s RAT.
IPV4	`45[.]151[.]74[.]119`	Listed as a direct C2 IP for the campaign’s RAT.
IPV4	`62[.]60[.]156[.]11`	Listed as a direct C2 IP for the campaign’s RAT.
SHA256	`26817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cad`	SHA-256 of the staged 7z.exe helper used to extract the downloaded archive.
SHA256	`2f592365de553d8bb023a9e11439c2e18dcbe84d22b0cd6025b043d7d9029ac7`	SHA-256 of LibBind.dll, identified as the sideloaded loader in the malware chain.
SHA256	`3a9b8eccad62d84fc59f86dae41e8c74ae6ae544f079b099b12b37de1abd7a60`	SHA-256 of the campaign’s password-protected payload archive, fdupdate.zip.
SHA256	`6bc18b6c6050bdd554c4a945838b8b3a35b5c5813b950cf5f2e822b2396718cf`	SHA-256 of Stream.Toolkit.dat, an accompanying data file used by the loader chain.
SHA256	`75d4b6cec5bdc40cda25b5b9be136ccca97d77843825796beace7ddbfe87b614`	SHA-256 of act.exe, the decoded Delphi loader in the malware chain.
SHA256	`8035b177ca682962fd6501228ebd460ef174183ac08a87d81514bba3ecfd9502`	SHA-256 of the final decoded RAT PE.
SHA256	`a7c94343b51643b7477ba2c7630b168ce3cb1f03126a85c39363e70742e3afb5`	SHA-256 of TBFVSS_DLL_SRV_64.dll, listed as a file indicator for the campaign.
SHA256	`d518964aa67c359d0a806909451130591e337276bea33b6d41ef79126904ca3a`	SHA-256 of fdupdate.exe, the signed updater used as a vehicle for DLL sideloading.