Artlist ClickFix Campaign Uses Infostealer

Gbhackers •Mayura Kathir • July 15, 2026

A threat campaign discovered in mid-July 2026 abused the compromised Artlist subdomain new-blog. artlist[.]io to distribute a Remote Access Trojan through a fake CAPTCHA prompt. The operation combined stolen WordPress credentials, blockchain-based EtherHiding infrastructure, ClickFix social engineering, DLL side-loading, and a Tor-backed command-and-control fallback. The incident affected a high-value web property. Similarweb data indicates that […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Artlist Subdomain Compromised in ClickFix Campaign Using EtherHiding Technique In July 2026, a ClickFix campaign was discovered on the Artlist subdomain new-blog.artlist[.]io, where attackers injected malicious code that masqueraded as a CAPTCHA to install a Remote Access Trojan (RAT). The attack originated from an infostealer infection traced back to a pirated software download in 2023, which compromised a developer's machine and provided access to high-privilege WordPress credentials. The attackers utilized a technique called EtherHiding, querying a smart contract on the Polygon blockchain to dynamically route to the malicious payload, avoiding detection. The campaign's infrastructure included a Tor-backed command-and-control (C2) fallback and DLL side-loading techniques. The incident highlights the growing trend of legitimate businesses being exploited as malware hosts. As of now, the campaign is still active, with ongoing investigations into the compromised components. 33 sources 68

Extracted Entities

Artlist ClickFix Campaign Uses Infostealer

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

Domains (1)

MITRE ATT&CK (2)

Platforms (2)