Loading story…
Threat actors compromised the official WordPress site for the open-source .NET decompiler ILSpy and used it as a software supply chain and watering-hole attack against developers. Visitors seeking the tool were no longer directed to ILSpy’s legitimate GitHub repository; instead, altered links on the site redirected them to a third-party page that prompted installation of a malicious browser extension before allowing the download process to continue.
The intrusion was discovered by researcher RootSuccess, who reported it to vx-underground, prompting public warnings as investigators began analyzing the extension to determine its payload and collect indicators of compromise. The affected ILSpy WordPress site was subsequently taken offline and began returning a 502 Bad Gateway error, underscoring how a compromise of a trusted software distribution channel can be leveraged to deliver spyware-capable malware to developers.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Following disclosure of the compromise, the affected ILSpy WordPress site was taken offline to prevent additional infections. Reports said the site began returning a 502 Bad Gateway error while analysis of the malicious extension continued.
Security researcher RootSuccess identified the compromise of the ILSpy WordPress site and documented the malicious redirection and browser-extension prompt. The incident was then reported to vx-underground, which publicly warned others about the attack.
Threat actors compromised the official WordPress domain for the open-source decompiler ILSpy and altered links to redirect visitors away from the legitimate GitHub repository. The hijacked site prompted users to install a malicious browser extension and then sent them to a third-party domain as part of a supply chain attack targeting developers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026
The threat actor **GrayCharlie** compromised WordPress websites and used them as malware delivery points, redirecting visitors to attacker-controlled pages that pushed **NetSupport RAT** and the **Stealc** information stealer. The campaign turned legitimate sites into staging infrastructure, allowing the attackers to infect users who visited the hacked pages and expand access beyond the initial web compromises. Reporting indicates the operation combined website compromise with malware distribution and data theft, using **NetSupport RAT** for remote access and **Stealc** to harvest sensitive information from infected systems. The activity highlights the dual risk posed by compromised WordPress environments: website owners lose control of trusted web assets, while visitors face malware infection and credential theft through seemingly legitimate sites.
Jul 12, 2026
Check Point Research uncovered **StopAndProtect**, a large-scale cybercrime operation that used compromised WordPress sites to host malware, provide command-and-control, and store stolen data. The campaign began with a **ClickFix** fake CAPTCHA lure that tricked victims into launching PowerShell, then deployed multiple `.NET` loader stages that installed a broad toolset including **SilentEncryptor** ransomware, the **SilentDataCollector** stealer, an SMB/USB worm, a VBS spreader, a lock-screen module, a credential stealer, and a custom chat utility for interacting with victims. Researchers said the operators made significant OPSEC mistakes that exposed their infrastructure, including open PHP directory listings, accessible log and screenshot folders, and archived files that appeared to show the actors had infected themselves. Those leaks revealed source code and operational files used to mass-manage compromised WordPress domains. Monitoring from mid-May through late July 2026 found more than **700** stolen-data archives and about **31,000** victim screenshots, while internal logs and exposed systems indicated the campaign hit thousands of IP addresses worldwide, with the highest concentrations in the **United States, Russia, and India**.
Sep 3, 2026