Kiran 
A newly documented WordPress mass-compromise campaign has stitched together nine distinct evasion techniques into a single attack chain, culminating in the Amatera password stealer, and researchers say they’ve never seen anything quite like its core trick before.
Netskope Threat Labs, in research published August 27, 2026, detailed a campaign hitting hundreds of WordPress sites that combines browser-level persistence, blockchain-based payload hiding, and a fileless execution chain designed to leave almost nothing for defenders to hash, seize, or inspect.
The attack begins with a rogue “must-use” plugin planted on compromised WordPress sites, which auto-loads on every page request.
EtherHiding Attack Uses Blockchain
That plugin registers a malicious Service Worker (nochain-sw.js) in the visitor’s browser. Once active, the worker strips the site’s Content-Security-Policy header from every HTML response and injects a hidden script.
Because the worker lives in the browser rather than on the server, it survives a full site cleanup it keeps running until someone explicitly unregisters it. The worker also checks for the wordpress_logged_in_ cookie and quietly skips injection for site administrators, ensuring the person most likely to notice the infection never sees it.
Rather than pulling instructions from a server that could be seized, the injected script queries a smart contract on Base, Coinbase’s Ethereum layer-2 network.
This technique, dubbed EtherHiding, turns the blockchain into a “dead-drop” resolver: the contract’s read-only functions return the payload a fake reCAPTCHA page and the operator can rewrite that payload at will without ever touching the victim’s site again.
The fake reCAPTCHA instructs victims to copy an mshta command and paste it into the Windows Run dialog, the now-common “ClickFix” social-engineering technique.
That command fetches a file disguised as an MP3 but structured as a polyglot containing an embedded HTA. The HTA creates a scheduled task that launches PowerShell through a wildcard-obscured path, patches the Antimalware Scan Interface to blind it, and runs entirely in memory.
The next stage, a loader called Emmenhtal, retrieves its real payload from a steganographic JPEG hosted on a legitimate image CDN data hidden inside pixel-block averages of a 5,608×5,608 image. The loader reflectively injects the final payload into memory, so nothing ever touches disk.
The payload is Amatera, a rebrand of the ACR Stealer (AcridRain) malware family, disguised as a file with forged metadata that mimics Microsoft’s Windows Performance Analyzer.
It steals credentials and system data, then exfiltrates them while resolving its command-and-control domain through DNS-over-HTTPS to Google and Cloudflare resolvers, hiding its C2 lookups inside encrypted DNS traffic.
“What’s striking here isn’t any single technique it’s the discipline of leaving nothing durable behind. Every layer, from the Service Worker to the on-chain contract to the in-memory loader, seems engineered around one question: what would a defender have to seize, hash, or scan to stop this? The answer, at nearly every step, is nothing.”
Netskope recommends blocking the beacon and stage-2 hosts at the network layer, explicitly purging Service Workers during incident remediation rather than just deleting files, and monitoring the associated Base smart contract for payload rotation, since operators can swap infrastructure on-chain without ever revisiting the compromised site.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
