Threat Actors Push ClickFix Fake Browser Updates Using Stolen Credentials

GoDaddy Security Researchers have identified a surge in malware distribution through fake WordPress plugins. These plugins appear legitimate but inject JavaScript for fake browser update prompts, leveraging social engineering to compromise users. Threat actors use stolen admin credentials to install these plugins on websites, rather than exploiting WordPress vulnerabilities. The malware employs blockchain technology and smart contracts to deliver payloads. Over 25,000 sites have been detected with this variant since August 2023, with over 6,000 affected since June 2024. The threat continues to evolve, using multiple vectors and automated processes to evade detection.