WordPress fake reCAPTCHA macOS stealer

Summary

Report URI published this on 23 September 2026 after following one domain from a threat feed. Its crawler and telemetry had by then found the campaign on more than 2,000 WordPress sites, government and diplomatic ones among them, each carrying one injected script dressed up as an analytics tag with a per-site token. The loader is served only to browser-like requests that name a compromised site as referrer, turns away crawlers and automated browsers, and shows its fake reCAPTCHA only to desktop Mac visitors, once each. The copied command decodes to a backgrounded curl that fetches and runs a script from a sanctioned Russian hosting provider, then clears the screen, scrubs shell history and prints a success tick. The payload is a Go stealer with fake Ledger and Trezor recovery screens; Report URI declines to name its family, noting overlaps with Atomic, Poseidon and Odyssey.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 102

Checks recorded

1

Checks since publication

1

Never checked

101

Observation window 2026-10-11 to 2026-10-11. Checks are sampled, not continuous; the sampling policy is on /methodology. 101 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 5 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

102 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.