---
title: ShadowCaptcha Campaign Hijacks 100+ WordPress Sites to Spread Malware
description: Cybercriminals exploit 100+ WordPress sites, using fake CAPTCHA to spread ransomware, steal data, and mine cryptocurrency.
canonical_url: https://codekeeper.co/ticker/shadowcaptcha-cyberattack-wordpress-sites
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# ShadowCaptcha Campaign Hijacks 100+ WordPress Sites to Spread Malware

Cybercriminals exploit 100+ WordPress sites, using fake CAPTCHA to spread ransomware, steal data, and mine cryptocurrency.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Aug 26, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are exploiting over 100 compromised WordPress sites in a campaign called ShadowCaptcha, first detected in August 2025 by Israel's National Digital Agency. The attack redirects visitors to fake CAPTCHA pages that trick users into downloading ransomware, cryptocurrency miners, and data-stealing malware. The scam uses social engineering tactics called ClickFix, automatically copying malicious commands to users' clipboards and instructing them to paste and run the code. Victims end up infected with Lumma and Rhadamanthys stealers, Epsilon Red ransomware, or XMRig cryptocurrency miners. Most targeted sites are in Australia, Brazil, Italy, Canada, Colombia, and Israel across various industries. The campaign demonstrates how attackers now combine multiple attack methods for maximum profit. **Source:** [The Hacker News](https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshadowcaptcha-cyberattack-wordpress-sites%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[FortiBleed Campaign Linked to Inc and Lynx Ransomware Gangs Aug 12, 2026](https://codekeeper.co/ticker/fortibleed-attack-ransomware-nextcloud-exploit)

[University of Nottingham Students 'Scared and Anxious' After Major Cyber-Attack Aug 12, 2026](https://codekeeper.co/ticker/university-of-nottingham-hack-student-data-breach)

[Hackers Exploiting Critical WordPress Plugin Flaw in Tens of Thousands of Attacks Aug 12, 2026](https://codekeeper.co/ticker/everest-forms-pro-plugin-vulnerability-exploit)

[Data breaches 153M Driver's Licenses for Sale, and the Trail Leads to One Vendor Sep 7, 2026](https://codekeeper.co/ticker/153m-drivers-licenses-dark-web-breach)