How to identify and remove a "ClickFix" infection on dispensary websites

ClickFix is a malware pattern that has become common across compromised WordPress sites. An attacker gains some form of access to a website (often through an outdated plugin, an outdated theme, or a compromised login) and injects a hidden script into the site's code. When certain visitors load the affected page, the injected script displays a fake "Verify you are human" screen. That screen convinces visitors to open a command prompt on their own computer and run a command that installs malware.

This matters for any business running its own WordPress site, including sites used alongside Dutchie E-Commerce or Dutchie Storefront. Cleaning up an infection like this quickly protects your site visitors from having malware installed on their computers, protects your search engine standing (search engines can flag sites that serve malware), and helps you close the access point the attacker used before they return.

If your team manages a WordPress site independently of Dutchie, use this article to understand what to look for, why it is worth prioritizing, and what a complete cleanup involves.

Things to know

• This issue lives entirely within your website's own code and hosting account. It does not affect the Dutchie platform, and your Dutchie POS and online ordering will continue to work as usual while you complete the cleanup.
• You will need administrator access to your WordPress dashboard, your hosting account, and FTP/SFTP access if you use it, to complete the steps in this article.
• If someone else manages your site on your behalf, such as a developer or hosting provider, share this article with them. The technical indicators section below contains the specific detail they will need to locate and remove the malicious code.
• No legitimate website ever asks a visitor to open the Run dialog or a terminal window to "prove" they are human. If anyone on your team sees a prompt like that on any site, the safe response is to close the tab.

How the ClickFix pattern works

Once decoded, this type of infection typically follows the same chain of events:

1. A hidden script loads a small program, often compiled to WebAssembly, built to disguise itself from casual inspection.
2. That program retrieves a file from one of several backup domains, disguised as an ordinary image file. Using a hidden key built into the script, it extracts a web address concealed inside that file. This technique is called steganography: hiding one piece of data inside another so it does not look suspicious to normal scanning.
3. The extracted address loads automatically and displays a fake "Verify you are human" or Cloudflare-style checkbox page to the visitor.
4. The fake page instructs the visitor to press Windows key + R, paste something, and press Enter. In reality, the page has already copied a malicious command to the visitor's clipboard the moment it loaded. Pasting it and pressing Enter runs that command.
5. The command typically opens PowerShell, downloads code from a remote domain, and runs it directly in memory. Because nothing is saved to disk, antivirus software may not catch it afterward.

How to tell if your site is infected

Because malicious code is often deliberately hidden, it usually will not be obvious from a normal page view. Look for warning signs across these areas:

What visitors might see

A visitor reports or you notice a page behaving unexpectedly: an unexpected redirect to another domain, a fake "verify you are human" or CAPTCHA-style prompt, a popup or ad that does not belong to your site, a prompt asking someone to copy and run a command, or a page that looks different depending on whether a search engine or a real visitor loads it.

Unusual code in your site's source

Review your page's HTML source (View Source, typically in the head or footer) for things that do not match anything your team added: a script tag with no id and no recognizable source, an unusually large or single-line block of code, text that looks like a long string of random characters (often base64), or a request to a domain you do not recognize.

Files that do not belong

Files in wp-content/uploads or other writable folders that are not images, PDFs, or media you uploaded; PHP files in folders that should only contain images or static assets; files with recent modification dates that do not line up with any change your team made; or core WordPress, theme, or plugin files that differ from a clean, official copy.

Accounts and access you do not recognize

An administrator account you cannot account for, a login from an unfamiliar location or at an unusual time, or a password that stopped working without your team changing it.

Search engine and traffic signals

A "This site may be hacked" or malware warning in Google Search Console, a sudden drop in search traffic, unfamiliar pages indexed under your domain (often spammy pharmaceutical, gambling, or foreign-language pages), or a security tool (browser warning, or antivirus)

If your team or a visitor sees anything that asks them to run a command, open a terminal, or take an unusual "verification" step, treat it as suspicious and do not follow the instructions. If you find code, files, or accounts matching any of the patterns above, move to the cleanup steps below. A developer or hosting provider can also compare your site's current files against a clean backup, which is often the fastest way to spot what changed.

Check for known active infections

Two Common Vulnerabilities and Exposures (CVE)  are actively being exploited and have been added to Cybersecurity and Infrastructure Security Agency’s (CISA)  Known Exploited Vulnerabilities catalog. 

• CVE-2026-6303
• CVE-2026-60137

Organizations running affected WordPress sites should treat this as urgent. 

Organizations operating affected WordPress installations should prioritize upgrading immediately, since applying the WordPress-provided update is the most effective way to remediate CVE-2026-63030. 

Specifically, sites running WordPress 6.9.0 through 6.9.4 should update to 6.9.5, and sites running 7.0.0 through 7.0.1 should update to 7.0.2; versions earlier than 6.9 aren't affected.

How to clean up an infected site

1. If it is practical for your business, take the site down or put it into maintenance mode while you complete the cleanup. If that is not practical, do not let it block you from starting the remaining steps.
2. Restore your theme and plugin files from clean, known-good copies, or reinstall them fresh from the official source. Deleting only the injected script is not sufficient, since the underlying access point the attacker used is often still open.
3. Audit every WordPress administrator account. Remove any account you do not recognize, and reset passwords on every remaining account.
4. Check for unfamiliar files, particularly inside wp-content/uploads, which is a common location for attackers to hide backdoor files.
5. Update WordPress core, your theme, and every installed plugin to their latest versions.
6. Rotate passwords for your WordPress administrator accounts, your hosting account, and FTP/SFTP if you use it.

How to prevent future infections

• Install a website firewall or malware scanner going forward. Tools like Wordfence and Sucuri are commonly used for this, and some hosting providers include similar protection by default.
• Keep WordPress core, your theme, and all plugins updated on a regular schedule, since outdated components are the most common way attackers gain initial access.
• Periodically review your list of WordPress administrator accounts and remove any that are no longer needed.
• Train your team to recognize the ClickFix pattern: if any site ever prompts a visitor to open the Run dialog or a terminal to complete a "human verification" step, the safe response is to close the tab.

Troubleshooting

Q: Will this affect my Dutchie POS or Dutchie E-Commerce? A: No. This type of infection lives entirely within your website's own code and hosting. Your Dutchie POS and online ordering will continue to work as usual while you complete the cleanup.

Q: I deleted the malicious script, but I am not sure the site is fully clean. What else should I check? A: Deleting the script removes the immediate symptom but not necessarily the access point. Complete all of the cleanup steps above, including restoring theme and plugin files from clean copies, auditing admin accounts, and checking for unfamiliar files in wp-content/uploads.

Q: How do I know which plugin or login was the original entry point? A: This is not always possible to determine after the fact. As a starting point, review whichever plugins, themes, or admin accounts are furthest behind on updates, since outdated components and compromised logins are the most common entry points.

Q: A visitor reported seeing a strange "verify you are human" screen on our site. What should I tell them? A: Advise them to close the tab and avoid pasting or running anything a website has instructed them to run. No legitimate site requires this step to verify a visitor is human.

Questions?

If you have questions about this article or believe your site may be affected, contact Dutchie Security at security@dutchie.com.