A malware campaign dubbed ‘Lorem Ipsum’ is using compromised WordPress websites to trick employees into manually running malicious commands on their Windows computers, bypassing standard security tools. Possible attribution to Vice Society, a threat actor known for ransomware and data theft targeting education and healthcare, elevates the business risk, though attribution remains low-to-medium confidence pending independent corroboration from higher-tier threat intelligence sources. Organizations whose employees browse the public web on Windows endpoints face exposure to ransomware deployment and data exfiltration without requiring any software vulnerability to be present.