NCSC-CH: Swiss websites compromised through WP2Shell are serving fake-CAPTCHA paste-and-run lures, with the follow-on payload resolved from a blockchain
UPDATE · originally covered CVE-2026-63030 / CVE-2026-60137 (WP2Shell) — WordPress Core pre-auth RCE chain moves to confirmed in-the-wild exploitation and CISA KEV (2026-07-26)
Switzerland's national cyber authority has attached its own jurisdiction's numbers to the WordPress chain this pipeline recorded reaching CISA KEV in July. In an advisory published 2026-08-07, BACS reports a rising count of compromised websites presenting fake CAPTCHAs that push visitors into executing a command themselves, puts the worldwide population of compromised sites at more than 100,000, and states it is currently seeing an increase in the number of Swiss websites being compromised and used to distribute malware (NCSC-CH, 2026-08-07).
The entry point is the already-covered one, now with reporting behind it: BACS writes that in recent days it has received an accumulation of reports from Swiss website operators and web-hosting providers describing exploitation of two recently disclosed WordPress vulnerabilities, and that "criminals use a combination of two vulnerabilities in WordPress" known as WP2Shell — CVE-2026-63030 and CVE-2026-60137 (NCSC-CH, 2026-08-07). Most of the compromised sites run WordPress.
What is new below the entry point is the delivery chain. Once a visitor follows the instruction and runs the command, it fetches further malicious code whose storage and distribution sit on a public blockchain — the technique BACS names EtherHiding — retrieved through the web interfaces of RPC providers that broker access to those networks; the payload is typically an infostealer, with Vidar named as an example, going after credentials, payment-card data and cryptocurrency wallets (NCSC-CH, 2026-08-07). That hop is why the authority's recommendation is an egress-policy one rather than a filtering one: a blockchain read has no domain to sinkhole.
Triage: the client-side execution has a distinctive shape in process-creation telemetry with parent lineage — a command interpreter (powershell.exe on Windows, the terminal shell on macOS) started from a browser process tree, immediately followed by outbound HTTP to an RPC-provider endpoint. Neither half is individually rare on a developer or administrator workstation; the sequence, on a general-office endpoint, is the signal, and the browser parentage is what separates it from legitimate admin scripting, which is not launched from a browser. On the server side, the compromise signature is the WP2Shell request pattern against the unauthenticated REST batch endpoint in web-server access logs, followed by administrator-account or plugin and theme file changes that no admin action accounts for.
Dabei verwenden Cyberkriminelle eine Kombination aus zwei Schwachstellen in WordPress
Unternehmen und Betreiberinnen kritischer Infrastrukturen, welche nicht im Fintech-Bereich tätig sind, sollten ausgehende Verbindungen zu RPC-Anbietern einschränken.
Defender actions
- Restrict outbound connections from user endpoints to blockchain RPC-provider web interfaces, per BACS's own recommendation for companies and critical-infrastructure operators that are not in fintech — this is the takedown-resistant hop the pasted command depends on.
- Confirm every WordPress instance the organisation or its agencies publish is on 6.9.5 / 7.0.2 or later, and for any site that was reachable and unpatched, check for attacker-added administrator accounts and modified theme or plugin files rather than only applying the update.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059.001Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
T1204.004User Execution: Malicious Copy and Paste
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.
Credential Access TA0006
T1555.003Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Command and Control TA0011
T1102.001Web Service: Dead Drop Resolver
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.