Impure Stealer

Impure Stealer is a .NET information-stealing malware family identified by Rapid7 during a large ClickFix campaign that used compromised WordPress websites to target primarily Windows systems. In the observed activity, attackers injected malicious JavaScript into legitimate WordPress sites and displayed fake Cloudflare verification or CAPTCHA prompts that instructed victims to copy and paste commands into the Windows Run dialog, resulting in manual execution of a multi-stage, largely in-memory infection chain. Rapid7 reported the broader operation had been active since at least December 2025, with some supporting infrastructure dating to July/August 2025, and involved more than 250 compromised websites across at least 12 countries.

Rapid7 described Impure Stealer as a previously unnamed .NET infostealer and noted that, in one infection chain, it replaced Vidar as the final payload: a second shellcode blob contained an encrypted .NET stealer that researchers named Impure Stealer. The campaign also delivered Vidar Stealer, VodkaStealer, and the DoubleDonut loader. Reported capabilities for the payloads in this campaign, including Impure Stealer, include harvesting browser credentials, authentication cookies, cryptocurrency wallet data, and other sensitive information from infected devices. Rapid7 also characterized the overall campaign goal as theft and exfiltration of credentials and digital wallets.

High-confidence infrastructure and behavioral details tied to the campaign include PowerShell stagers retrieving content from 91.92.240[.]219 and 178.16.53[.]70, downloading shellcode such as cptch.bin and cptchbuild.bin from 94.154.35[.]115, and injecting payloads into svchost.exe. Rapid7 reported that final payload hosting later moved to 172.94.9[.]187 in early March 2026. The campaign used heavily obfuscated JavaScript, anti-analysis checks, localized fake CAPTCHA lures in at least 31 languages, and Donut-based shellcode loaders in a two-stage sequence dubbed DoubleDonut. No specific threat actor attribution for Impure Stealer itself was provided in the content.