Cybersecurity
Fake “verify you are human” prompts on hacked Australian websites spread password-stealing malware
The ACSC has seen legitimate Australian business websites used to show fake Cloudflare checks that ask visitors to paste and run a command. Doing so installs malware that steals passwords and browser data.
What happened
The ASD’s ACSC published an advisory about ClickFix, a social engineering technique that has spread since early 2024. Since early 2026, the ACSC has seen attacks on Australian networks that use websites belonging to legitimate Australian businesses.
Attackers break into a WordPress site and inject code that replaces the real page with a fake Cloudflare “Verify you are human” check. When a visitor ticks the box, the page quietly copies a command to their clipboard and shows instructions to paste it into Windows and run it, sometimes with administrator rights.
That command downloads Vidar Stealer, malware that steals saved passwords, browser data, cryptocurrency wallets and system information.
Why it works
People are used to CAPTCHA checks, and the page appears on a site they trust. Because the visitor runs the command themselves, it can slip past some security controls that would block a normal download.
The one rule for staff
No genuine website or CAPTCHA will ever ask you to press keys to open a Run box, Terminal or PowerShell and paste something in. If you see instructions like “Press Windows + R, then Ctrl + V, then Enter”, close the page.
If someone has already done it, disconnect the computer from the network, tell your IT contact, and change passwords from a different device. See what to do if you’ve been scammed.
If you run a WordPress website
Your site could be the one showing the fake check to your customers. The ACSC recommends:
- Patch and secure WordPress, including plugins and themes, and remove anything unused.
- Use phishing-resistant MFA and least privilege for website admins.
- Watch for unexpected changes to site files and injected scripts, and check the site regularly in a private browser window.
Our website security checklist covers these steps.
For IT teams
The advisory also recommends restricting PowerShell and script execution for standard users, blocking known malicious domains, monitoring outbound traffic, and using endpoint detection and response. It includes indicators of compromise and detection guidance.
Where to get help
Call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) or report through ReportCyber.
Sources
- ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructureAustralian Signals Directorate · 17 June 2026Open source