Australia Warns of ClickFix Campaign Delivering Vidar Stealer

Summary

The ACSC warns that attackers are using compromised WordPress sites and fake verification prompts to trick Australian organizations into running PowerShell commands that deliver Vidar Stealer. It recommends restricting PowerShell, allow-listing applications, and patchin

Key points

The ACSC says an ongoing ClickFix campaign targets Australian organizations and infrastructure entities.
Compromised WordPress sites display fake CAPTCHA or Cloudflare verification prompts that direct users to run malicious PowerShell commands.
The commands deliver Vidar Stealer, which targets browser passwords, cookies, cryptocurrency wallets, autofill data, and system details.
The article says Vidar deletes its executable after launch and operates from system memory, reducing forensic artifacts.
The article describes Vidar retrieving command-and-control addresses through dead-drop URLs hosted on services such as Telegram and Steam.
The ACSC recommends restricting PowerShell, using application allow-listing, and updating or removing unused WordPress themes and plugins.

Article Details

Event Type: Ongoing ClickFix social engineering campaign distributing Vidar Stealer through compromised WordPress websites.
Impact: Australian organizations and infrastructure entities are targeted. Victims may be tricked into executing malicious PowerShell commands, resulting in theft of browser passwords, cookies, cryptocurrency wallets, autofill data, and system details. Vidar Stealer reportedly deletes its executable after launch and operates from system memory, reducing forensic artifacts.

MITRE ATT&CK

T1059.001 · PowerShellVictims are instructed to copy and execute malicious PowerShell commands to deliver Vidar Stealer.T1204.001 · Malicious LinkFake CAPTCHA or verification prompts trick users into manually executing malicious commands.

Malware

VidarThe Australian Cyber Security Center (ACSC) is warning that Australian organizations are being targeted in a ClickFix campaign that uses fake verification prompts on compromised WordPress sites to deliver Vidar Stealer.

Products

PowerShellVictims are tricked into running malicious PowerShell commands that install Vidar Stealer.WordPressThe Australian Cyber Security Center (ACSC) is warning that Australian organizations are being targeted in a ClickFix campaign that uses fake verification prompts on compromised WordPress sites to deliver Vidar Stealer.