--- title: Crooks compromise WordPress sites, spread infostealers description: Researchers at Rapid7 have uncovered a large-scale campaign in which attackers compromised over 250 WordPress sites across 12 countries, including a US Senate... canonical: https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Crooks compromise WordPress sites, spread infostealers | daily.dev og:description: Researchers at Rapid7 have uncovered a large-scale campaign in which attackers compromised over 250 WordPress sites across 12 countries, including a US Senate... og:url: https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup og:image: https://api.daily.dev/og/posts/UsQNj2Nup.png og:image:alt: Crooks compromise WordPress sites, spread infostealers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Crooks compromise WordPress sites, spread infostealers **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Researchers at Rapid7 have uncovered a large-scale campaign in which attackers compromised over 250 WordPress sites across 12 countries, including a US Senate candidate's campaign page. The sites were injected with malicious code that displays fake Cloudflare CAPTCHA prompts, tricking visitors into running commands that install infostealer malware. The technique is part of the ClickFix social engineering playbook. Stolen credentials — including browser passwords, cookies, and crypto wallet data — are then sold on cybercrime marketplaces. The campaign has been active since at least December 2025, with infrastructure dating back to mid-2024, and the scale suggests a highly automated, organized criminal operation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Crooks compromise WordPress sites, spread infostealers","url":"https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup"},"datePublished":"2026-03-10T16:34:20.313Z","dateModified":"2026-03-10T16:34:42.353Z","description":"Researchers at Rapid7 have uncovered a large-scale campaign in which attackers compromised over 250 WordPress sites across 12 countries, including a US Senate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/56a318c9e7983d42d416bec7922f06ff?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/56a318c9e7983d42d416bec7922f06ff?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/crooks-compromise-wordpress-sites-spread-infostealers-usqnj2nup","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,wordpress","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Crooks compromise WordPress sites, spread infostealers"}]} ```