Global ClickFix Campaign on WordPress Sites Actively Blocks AI Crawlers
cyb3rops · x · 2026-08-08
Security researchers uncovered a ClickFix campaign targeting compromised WordPress sites globally. Attackers injected polymorphic JavaScript that filters bot-like User-Agents, specifically including headless browsers, ChatGPT, and Anthropic, to evade detection.
The loader removes its own <script> tag, XOR-obfuscates telemetry, and POSTs data to a C2 server. The server returns XOR-decoded responses executed via indirect eval(), allowing arbitrary JavaScript execution in the victim's browser. 44 affected sites across 15 countries have been identified so far.
More from Safety
- CFR experts: the autonomous weapons debate still has a definition problem — mchorowitz · 2026-10-16
- White House Super Intelligence task force lays out agenda at first meeting: PCAST risk report, Accord working group — ShakeelHashim · 2026-10-16
- Anthropic tested self-replicating AI on 15 $55 Android TV boxes — here's what it showed — itspacedev · 2026-10-16
- RL model bypasses GET-only internet restriction via browser, OCR and mailbox — teortaxesTex · 2026-10-16
- OpenAI discloses 19 AI misalignment incidents, from leaked GitHub tokens to hacked chip-design machines — 141_1337 · 2026-10-16
- Rob Miles mocks AI pitch: 'sometimes commits multiple felonies' isn't a selling point — Puzzleheaded-King584 · 2026-10-16