Loading story…
Researchers reported malware campaigns abusing WordPress xmlrpc.php to compromise sites through the pingback feature and distributed password attacks against weak administrator credentials. Zscaler described a previously unattributed malware family, Win32.Backdoor.WPbrutebot, that pulls WordPress targets from a command-and-control server, fingerprints exposed sites, and attempts brute-force logins via XML-RPC before downloading updated payloads such as svchst.exe. The malware uses XOR-obfuscated strings, blockchain DNS resolution for k6239847[.]lib, and infrastructure including 217.8.117[.]48, while related samples also relied on .space domains for command-and-control activity.
ESET documented a similar WordPress-focused botnet pattern in Sathurbot, which spread through fake torrent downloads, enrolled infected endpoints into a botnet, and used those systems to crawl the web and launch distributed XML-RPC password attacks. Compromised WordPress sites were then repurposed to host torrent-themed pages, and infected machines could fetch additional malware including Boaxxe, Kovter, and Fleercivet. Across both reports, defenders were urged to harden WordPress administration, disable XML-RPC where possible, avoid third-party logins, and monitor for known indicators tied to DNS-based command-and-control and brute-force activity.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabZ analyzed a malware campaign targeting WordPress sites through XML-RPC abuse, including pingback-based fingerprinting and brute-force attempts using wp.getUsersBlogs. The researchers named the previously unattributed malware family Win32.Backdoor.WPbrutebot and linked it to C2 infrastructure including k6239847[.]lib and 217.8.117[.]48.
On April 6, 2017, ESET published analysis of Sathurbot, describing a botnet of more than 20,000 infected computers that abused WordPress XML-RPC via wp.getUsersBlogs for distributed password attacks. The report also detailed its fake-torrent infection chain, DNS TXT-based C2 discovery, and delivery of additional malware such as Boaxxe, Kovter, and Fleercivet.
ESET reported that the Sathurbot botnet had been active since at least June 2016. The botnet used fake torrent downloads to infect users and then leveraged infected systems for WordPress-focused crawling and XML-RPC password attacks.
A technical blog post described security risks in WordPress XML-RPC, including system.multicall being used to batch brute-force login attempts and pingback.ping being abused for reflection-style DDoS. It also noted an older pingback.ping SSRF flaw had been fixed in WordPress 3.5.1 and warned that some common .htaccess blocking patterns for xmlrpc.php were ineffective.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 83 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcewelivesecurity.com
Open sourcembsd.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026
Check Point Research uncovered **StopAndProtect**, a large-scale cybercrime operation that used compromised WordPress sites to host malware, provide command-and-control, and store stolen data. The campaign began with a **ClickFix** fake CAPTCHA lure that tricked victims into launching PowerShell, then deployed multiple `.NET` loader stages that installed a broad toolset including **SilentEncryptor** ransomware, the **SilentDataCollector** stealer, an SMB/USB worm, a VBS spreader, a lock-screen module, a credential stealer, and a custom chat utility for interacting with victims. Researchers said the operators made significant OPSEC mistakes that exposed their infrastructure, including open PHP directory listings, accessible log and screenshot folders, and archived files that appeared to show the actors had infected themselves. Those leaks revealed source code and operational files used to mass-manage compromised WordPress domains. Monitoring from mid-May through late July 2026 found more than **700** stolen-data archives and about **31,000** victim screenshots, while internal logs and exposed systems indicated the campaign hit thousands of IP addresses worldwide, with the highest concentrations in the **United States, Russia, and India**.
Sep 3, 2026
Gootloader operators continued to refresh their command-and-control infrastructure while maintaining a malware delivery chain built on compromised WordPress sites, fake forum pages, and malicious ZIP archives containing obfuscated JavaScript. Reporting shows the actor shifted key domains and IPs over time—from `my-game.biz`, `inerino.co.za`, and `za-co-za.co.za` to `new-game[.]me`, `luckyserver777.co.za`, and most recently `hotheads.co.za` at `91.215.85.21`—with infected systems observed contacting the newest server shortly after the change. Researchers also found malicious PHP injected into WordPress files including `xmlrpc.php`, `functions.php`, `404.php`, and upload paths, with additional logic hidden in the WordPress database to collect victim metadata and relay commands. Hands-on analysis confirmed the malware remains operational despite claims it was broken: a reproduced infection on Windows 11 showed file writes, scheduled-task persistence, PowerShell execution, and outbound beaconing that encoded host-enumeration data in HTTP Cookie headers. Earlier intrusion reporting tied Gootloader to a more severe post-compromise chain in which initial JavaScript execution led to PowerShell backdoors, Cobalt Strike deployment through DLL hijacking, SystemBC use, lateral movement with remote services and PsExec, and attempts to disable Microsoft Defender. The rapid domain rotation, updated JavaScript hiding techniques, and possible dependence on newer PowerShell behavior indicate an active effort to evade detection and preserve access to Windows environments.
Aug 15, 2026