Hacked sites deliver Vidar infostealer to Windows users

Cybercriminals have been leveraging compromised WordPress websites to distribute the Vidar infostealer malware to Windows users, exploiting human psychology rather than technical vulnerabilities. The attackers use fake CAPTCHA pages to trick victims into installing a malicious installer, which ultimately delivers the Vidar infostealer. This campaign employs multiple infection chains, making it more challenging to detect and mitigate. The use of compromised websites as a delivery mechanism allows the attackers to reach a broader audience, increasing the potential impact of the campaign¹. The Vidar infostealer is a significant threat, as it can extract sensitive information from infected systems, including login credentials and financial data. This type of attack has implications that extend beyond the immediate target, as state-aligned threat activity can raise the stakes from criminal to geopolitical, making it a concern for organizations and individuals alike.