Attackers turned hundreds of hacked WordPress sites into a delivery network for an information stealer this summer, and the program doing the running was not malware at all. It was Deno, a legitimate JavaScript runtime that developers install on purpose.
Researchers at the Sophos Counter Threat Unit investigated a June 2026 campaign in which compromised WordPress sites served Cloudflare themed ClickFix lures. ClickFix is the social engineering trick where a fake verification page tells visitors to copy a command to their clipboard and paste it into Windows Terminal themselves, which sidesteps the download warnings an attacker would otherwise have to beat. On June 3 and June 4, people who followed those instructions ran a PowerShell command that kicked off an MSI based staging chain.
How the attack works
The MSI dropped two scripts into the user's AppData folder, november85.cmd and Griffin20.ps1. Those called winget.exe, the package manager built into Windows, to download and install the Deno runtime. The legitimate deno.exe then fetched and executed JavaScript from attacker infrastructure at webstizkgao[.]com. As the Sophos CTU report puts it, that let the operators run remote code without a conventional malware loader anywhere in the chain.
Deno then became the orchestrator. It ran further PowerShell, profiled the machine, and established persistence through registry Run keys that launch JavaScript inside a headless conhost.exe process. A scheduled task kept pulling fresh JavaScript from hxxp://webstizkgao[.]com/v020def066f14754be9.js. On June 23 that payload changed to stage from a free TryCloudflare address, hxxps://ordinary-computer-analytical-spell[.]trycloudflare[.]com/c, and stored what it retrieved in a registry key dressed up as a Microsoft Edge update.
What gets stolen
The final payload was a Python file, install.pyc, run through pythonw.exe after being pulled from 162[.]33[.]177[.]16. Sophos analysts confirmed it is an infostealer capable of collecting system information, browser and extension data, cryptocurrency wallet information and keystrokes.
How widely
CTU researchers identified more than 500 compromised WordPress sites carrying similar injections that talk to columbnezhjdq[.]com and webstizkgao[.]com. That volume, they say, indicates the operators scaled delivery through bulk website compromise rather than picking targets by hand. The first stage domain was registered on June 1, 2026, five days after the second stage domain.
A companion investigation by Sophos MDR responders Wong Jun Qi and Krishna Priya Vijayakumar found the same runtime abuse across several unrelated intrusions earlier in 2026. Initial access varied from case to case, but the follow on framework repeated: bring your own runtime, install Deno, execute obfuscated JavaScript in memory. The v2.3 release of Deno in May 2025 introduced trusted, code signed distributions, which the researchers note reduces the chance of security controls flagging the binary, and the runtime can retrieve remote code and run from user writable directories with broad permissions.
What you should do
Sophos recommends that organizations monitor and restrict unauthorized use of Deno, review any execution of deno.exe from user writable directories, investigate persistence events involving Deno, and block the infrastructure listed below. Site owners should also audit their pages for injected script tags, because the WordPress operators here were victims too. It is a familiar shape: a malware for hire kit hijacked WordPress sites the same way in June, and fake fix prompts pushed ACR Stealer at corporate browsers in July.
Indicators
- columbnezhjdq[.]com, hosted the first stage loader script
- webstizkgao[.]com, hosted the second stage Deno JavaScript
- 162[.]33[.]177[.]16, hosted the Python infostealer
- ordinary-computer-analytical-spell[.]trycloudflare[.]com, later staging infrastructure
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.