Hackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks

Cybersecurity researchers have warned that attackers are abusing WordPress themes to drive Next-Gen ClickFix phishing campaigns. According to Sucuri, the campaign injects malicious content into a theme-related file (functions.php) to load code that redirects visitors to sketchy sites via a remote loader.

The loader sends an HTTP POST to the domain brazilc[.]com, which replies with a dynamic payload that includes a JavaScript file hosted on porsasystem[.]com and a hidden 1x1 pixel iframe that mirrors legitimate Cloudflare assets to aid the attack. The porsasystem[.]com domain has been flagged as part of a traffic distribution system known as Kongtuke, with infection chatter tracing back to a Mastodon post from 19 September 2025 describing the chain starting at a compromised site.

The report also notes a phishing kit called IUAM ClickFix Generator detailed by Palo Alto Networks Unit 42, capable of producing custom landing pages and enabling features such as clipboard manipulation and OS detection to tailor infections. Experts emphasise securing WordPress sites, keeping plugins and themes up to date, and monitoring for unexpected administrator accounts. according to Sucuri