ACSC ClickFix mitigation guidance for Vidar Stealer
Advisory/Mitigation
Summary
Hide ▲
Show ▼
The ACSC issued mitigation guidance for an ongoing ClickFix campaign that is pushing Vidar Stealer through malicious PowerShell commands, increasing credential-theft risk for Australian organizations. Attackers are abusing compromised WordPress sites and fake Cloudflare/CAPTCHA prompts to make users execute the payload themselves. The advisory tells defenders to restrict PowerShell execution and use application allow-listing to reduce exposure.
Related Happenings
Global CMS webshell exploitation campaign
Campaign
H score35
First: 13.07.2026 11:30
Last: 13.07.2026 11:30
Sources 1
About this happening:
A global CMS exploitation campaign is actively scanning websites for vulnerable software and plugins, creating immediate risk of webshell deployment and broader compromi...
Global CMS webshell exploitation campaign
CampaignAbout this happening: A global CMS exploitation campaign is actively scanning websites for vulnerable software and plugins, creating immediate risk of webshell deployment and broader compromi...
Vidar Stealer ClickFix campaign targeting multiple sectors
Campaign
H score38
First: 08.05.2026 14:00
Last: 08.05.2026 14:00
Sources 1
How related:
The ACSC has warned that a widespread campaign to distribute the malware combines compromised WordPress sites with ClickFix techniques.
About this happening:
The Vidar Stealer campaign is using ClickFix social engineering and compromised WordPress sites to deliver password-stealing malware, widening risk for infrastructur...
Vidar Stealer ClickFix campaign targeting multiple sectors
CampaignHow related: The ACSC has warned that a widespread campaign to distribute the malware combines compromised WordPress sites with ClickFix techniques.
About this happening: The Vidar Stealer campaign is using ClickFix social engineering and compromised WordPress sites to deliver password-stealing malware, widening risk for infrastructur...
Snow malware suite deployment by UNC6692
Malware Activity
H score29
First: 25.04.2026 18:07
Last: 25.04.2026 18:07
Sources 1
About this happening:
UNC6692 has deployed the Snow malware suite through social engineering, creating a stealthy path to credential theft and domain compromise. The operation uses em...
Snow malware suite deployment by UNC6692
Malware ActivityAbout this happening: UNC6692 has deployed the Snow malware suite through social engineering, creating a stealthy path to credential theft and domain compromise. The operation uses em...
2025 Rise in legitimate-access intrusions across enterprise sectors
Trend
H score28
First: 01.04.2026 17:05
Last: 01.04.2026 17:05
Sources 1
About this happening:
Legitimate access abuse is now a leading intrusion pattern across 2025 investigations, increasing the risk of stealthy compromise across manufacturing, healthcare, MSPs,...
2025 Rise in legitimate-access intrusions across enterprise sectors
TrendAbout this happening: Legitimate access abuse is now a leading intrusion pattern across 2025 investigations, increasing the risk of stealthy compromise across manufacturing, healthcare, MSPs,...
Venom Stealer MaaS continuous credential theft and exfiltration
Malware Activity
H score29
First: 01.04.2026 16:30
Last: 01.04.2026 16:30
Sources 1
About this happening:
The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...
Venom Stealer MaaS continuous credential theft and exfiltration
Malware ActivityAbout this happening: The Venom Stealer malware-as-a-service platform has been identified as a credential-theft threat that keeps exfiltrating data after infection, extending the window for...
Timeline
-
07.05.2026 21:00 2 articles · 2mo ago
ACSC warns of ongoing ClickFix-driven Vidar Stealer campaign
Initial DisclosureThe Australian Cyber Security Center (ACSC) warned that an ongoing ClickFix campaign is targeting Australian organizations and infrastructure entities by using compromised WordPress websites, fake Cloudflare verification or CAPTCHA prompts, and malicious PowerShell commands to deliver Vidar Stealer. The advisory also said the malware retrieves command-and-control details through dead-drop URLs that use services such as Telegram bots and Steam profiles, deletes its executable after launch, and can operate from system memory to reduce forensic artifacts. ACSC provided indicators of compromise and advised organizations to restrict PowerShell execution, implement application allow-listing, and have WordPress site administrators apply security updates for themes and add-ons and remove unused plugins.
Show sources
- Australia warns of ClickFix attacks pushing Vidar Stealer malware — www.bleepingcomputer.com — 07.05.2026 21:00
- Australian Cyber Security Centre Issues Alert Over ClickFix Attacks — www.infosecurity-magazine.com — 08.05.2026 14:00