Cybercriminals Exploit 2,000 Hacked WordPress Sites for Malware Distribution and Data Theft

Cybercriminals leveraged nearly 2,000 compromised WordPress sites to deploy a multi-stage malware toolkit for data theft, ransomware, and command-and-control operations. The attack exploited outdated WordPress versions and plugins, using social engineering and custom plugins to exfiltrate sensitive data and maintain persistence.

Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity.

"The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software

Read original article