MalwareExploits 2 CVEs

TIKTOUK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-60137SQL Injection in WordPress WP_Query author__not_in

LevelBlue linked the request structures to CVE-2026-60137 and CVE-2026-63030, but did not demonstrate successful exploitation. Controlled targets returned prepared responses without executing SQL.

via cyber security newscybersecuritynews.com

CVE-2026-63030WordPress REST API batch-route confusion (WP2Shell component)

Attackers using a toolkit called TIKTOUK search WordPress sites for exposed backups and sensitive files, recover stored email passwords, and scan delivered JavaScript for cloud and API secrets.

via cryptika blogcryptika.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

The probing component identifies WordPress sites and sends REST batch requests combining a malformed URL with delete and paragraph-rendering operations. LevelBlue linked the request structures to CVE-2026-60137 and CVE-2026-63030, but did not demonstrate successful exploitation.

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence2

“A separate collection component retrieves an exposed WordPress configuration backup and extracts database credentials and security keys. It also requests environment settings, repository configuration, database backups, and debug logs.”

T1555Credentials from Password StoresEvidence2

“The collector supports encrypted settings from WP Mail SMTP, Easy WP SMTP, and FluentSMTP. Researchers verified that it recovered plaintext credentials using the corresponding encryption keys or WordPress configuration material.”

Collection

2 techniques

T1005Data from Local SystemEvidence1

“Nested batch requests contain expressions designed to retrieve database option values. The component first requests the options table name, then uses the returned name in subsequent queries.”

T1119Automated CollectionEvidence1

“The JavaScript crawler fetches pages and referenced scripts, scans their contents, and sends matches to the hub.”

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

“Each retrieves tasks from a central HTTP service and returns findings or status reports.”

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

“Each retrieves tasks from a central HTTP service and returns findings or status reports.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Oct 2, 2026

Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials

A modular toolkit comprising Python probing and credential-collection components plus a Go-based JavaScript crawler. It targets exposed WordPress backups and related sensitive files to obtain database credentials, WordPress keys, email passwords, AWS key pairs, and API secrets. It can decrypt supported SMTP-plugin settings when the requisite WordPress configuration material is available, derive Amazon SES credentials from AWS secrets, and report collected results to central HTTP control infrastructure.

cryptika blogNews

Oct 2, 2026

Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials | Cryptika Cybersecurity

A multi-component Python and Go credential-harvesting toolkit. It probes WordPress targets, retrieves exposed configuration backups and other sensitive files, extracts database and WordPress key material, decrypts supported SMTP-plugin settings, derives Amazon SES credentials from AWS secrets, and scans JavaScript for exposed AWS, SendGrid, Anthropic, and Bedrock credentials.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 2 CVEs

TIKTOUK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2026-60137SQL Injection in WordPress WP_Query author__not_in

LevelBlue linked the request structures to CVE-2026-60137 and CVE-2026-63030, but did not demonstrate successful exploitation. Controlled targets returned prepared responses without executing SQL.

via cyber security newscybersecuritynews.com

CVE-2026-63030WordPress REST API batch-route confusion (WP2Shell component)

Attackers using a toolkit called TIKTOUK search WordPress sites for exposed backups and sensitive files, recover stored email passwords, and scan delivered JavaScript for cloud and API secrets.

via cryptika blogcryptika.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

Credential Access

2 techniques

T1552.001Credentials In FilesEvidence2

T1555Credentials from Password StoresEvidence2

Collection

2 techniques

T1005Data from Local SystemEvidence1

“Nested batch requests contain expressions designed to retrieve database option values. The component first requests the options table name, then uses the returned name in subsequent queries.”

T1119Automated CollectionEvidence1

“The JavaScript crawler fetches pages and referenced scripts, scans their contents, and sends matches to the hub.”

Command and Control

1 technique

T1071.001Web ProtocolsEvidence2

“Each retrieves tasks from a central HTTP service and returns findings or status reports.”

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

“Each retrieves tasks from a central HTTP service and returns findings or status reports.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Oct 2, 2026

Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials

cryptika blogNews

Oct 2, 2026

Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials | Cryptika Cybersecurity

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.