“This activity is targeting Australian infrastructure and organisations across multiple sectors,” the ACSC said in a May 7 advisory.

“The campaign uses compromised WordPress websites to redirect victims to malware delivery mechanisms.”

What is ClickFix

ClickFix is a social engineering technique first observed in 2024 and popular for a range of cyber criminal activities, from spreading malware to harvesting credentials.

The technique takes advantage of fake CAPTCHA puzzles to convince users to undertake a malicious action, such as running a command or script. It’s a popular technique, as the user-driven activity can often bypass some security measures.

“Since early 2026, ASD's ACSC has become aware of a number of attacks targeting Australian networks, using websites belonging to legitimate Australian businesses as a part of the ClickFix attack vector,” the ACSC said.

In this instance, the ClickFix technique is being used to deliver the Vidar Stealer infostealer, a malware capable of harvesting credentials, crypto-wallet details, and browser data. The initial compromise of this data is often used for further malicious activity.

Vidar Stealer is capable of several evasion techniques to maintain persistence on a device, and, once installed, communicates regularly with its associated command-and-control infrastructure.

For more information on how to mitigate the issue, you can read the ASD’s ACSC’s advisory here.