Deno-runtime ClickFix on WordPress

Summary

Sophos's Counter Threat Unit published this on 11 August 2026 about a campaign it investigated on 3 and 4 June 2026. Script injected into compromised WordPress sites, more than 500 of them, ran environment checks and then showed a Cloudflare-themed prompt asking visitors to run a PowerShell command in Windows Terminal. The command started an MSI whose embedded scripts used winget to install Deno, the legitimate JavaScript runtime, and had it run remote JavaScript from the operators' server. Deno then orchestrated the rest: more PowerShell, reconnaissance, Run-key persistence, and a Python stealer run through pythonw that collects system, browser, extension, wallet and keystroke data. A scheduled task kept Deno fetching fresh script, which on 23 June switched to staging through a TryCloudflare tunnel. Sophos notes that signed Deno builds are less likely to be flagged.

Overlap with other campaigns

We compared the 4 indicators in this record — covering 3 distinct registrable domains — against the 60 other published campaigns in this corpus.

• Interlock ransomware and FileFix

  2026-08-07

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • trycloudflare[.]comdomain, shown defanged for safety: trycloudflare dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

4 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.