Loading story…
LevelBlue researchers identified TIKTOUK, a credential-harvesting toolkit that probes WordPress sites for publicly exposed backups, configuration files, and other sensitive material. Its Python components fingerprint targets, send distinctive REST batch requests, retrieve exposed data, and extract credentials from supported SMTP plugins, while a Go crawler searches public JavaScript for embedded secrets. The toolkit targets database, email, cloud, and API credentials and sends collected results to centralized HTTP endpoints.
A leaked TIKTOUK control panel reportedly contained about 50,000 server-side credentials from roughly 37,000 domains, including hundreds of AWS keys said to have been validated as active. Researchers linked elements of its request structure to CVE-2026-60137 and CVE-2026-63030, but did not demonstrate exploitation or SQL execution against a live production WordPress site. Telemetry confirmed payload retrieval and controller communications, and investigators also identified a related Go botnet with remote-command-execution capability; organizations should remove publicly reachable backup and configuration files and rotate potentially exposed credentials.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Incident telemetry confirmed payload retrieval and communications with TIKTOUK controller infrastructure, including 31.56.58[.]59. Investigators also identified a related Go botnet binary with remote command-execution capability.
Researchers linked elements of TIKTOUK's REST batch request structure to CVE-2026-60137 and CVE-2026-63030. They did not demonstrate successful exploitation of either vulnerability or SQL execution against a live production WordPress site.
LevelBlue identified TIKTOUK as a toolkit that probes WordPress sites for exposed backups, configuration files, logs, database dumps, and JavaScript secrets, then collects database, email, cloud, and API credentials. Its components include Python probing and credential-collection tools and a Go-based JavaScript crawler that report to centralized HTTP infrastructure.
Investigators found a leaked TIKTOUK control panel containing approximately 50,000 server-side credentials associated with roughly 37,000 domains. The panel included hundreds of AWS access keys that operators reportedly had validated as active.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcelevelblue.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A suspected Chinese-speaking threat actor tracked by GreyNoise as **Kapibala**, and assessed as the same as or related to Red Heron, exploited the `wp2shell` WordPress chain—`CVE-2026-63030` and SQL-injection flaw `CVE-2026-60137`—to compromise at least 49 organizations across 29 countries. The campaign deployed custom webshells, created hidden WordPress administrator accounts, stole database configuration and credential data, and used password spraying to access internal SQL services. A Western government organization lost at least 18,566 records containing account data, plaintext passwords, and personally identifiable information. The actor also exploited `CVE-2026-7273` in ZyXEL GS1900 switches, targeting 996 devices in 48 countries and collecting configurations, hashed root credentials, and network data, while scanning other exposed products including Ubiquiti UniFi OS, Gitea, Proxmox VE, FlowiseAI, and Nuclio. WordPress has patched `CVE-2026-60137` in versions 6.8.6, 6.9.5, and 7.0.2; affected organizations should update immediately, rotate potentially exposed credentials, remove unauthorized administrator accounts, investigate for webshells, restrict database access, and monitor for password spraying and bulk archive downloads.
Sep 23, 2026
An exposed server tied to the **WP-SHELLSTORM** cybercrime operation revealed tooling, logs, command history, and target lists for a large-scale webshell campaign aimed primarily at **WordPress** sites, with additional targeting of **Joomla** and enterprise Java platforms. Researchers said the group scanned more than **1.4 million domains**, exploited **27 CVEs**—including the Breeze plugin flaw `CVE-2026-3844`—and maintained roughly **5,700 active webshells**, while some analysis put validated compromises as high as **25,195**. The operation used layered implants including BestShell-derived webshells, a **SNOWLIGHT** dropper, and a **VShell** payload disguised as a Linux `kworker` process, then resold access to compromised websites. The exposed infrastructure also linked the operators to a separate campaign against **Nacos** deployments, where they exploited the authentication bypass `CVE-2021-29441` and stole **613 configuration files** from **11 systems** across **nine organizations**. Investigators assessed the activity with medium-to-high confidence as **financially motivated** and likely conducted by **Chinese or Chinese-speaking** operators rather than a state-backed APT, citing Simplified Chinese artifacts, FOFA usage, and overlap between the web and Java intrusion sets. The operators reportedly tried to alter access logs after the server was discovered, but the exposure had already disclosed extensive indicators of compromise and operational details.
Jul 23, 2026
Check Point Research uncovered **StopAndProtect**, a large-scale cybercrime operation that used compromised WordPress sites to host malware, provide command-and-control, and store stolen data. The campaign began with a **ClickFix** fake CAPTCHA lure that tricked victims into launching PowerShell, then deployed multiple `.NET` loader stages that installed a broad toolset including **SilentEncryptor** ransomware, the **SilentDataCollector** stealer, an SMB/USB worm, a VBS spreader, a lock-screen module, a credential stealer, and a custom chat utility for interacting with victims. Researchers said the operators made significant OPSEC mistakes that exposed their infrastructure, including open PHP directory listings, accessible log and screenshot folders, and archived files that appeared to show the actors had infected themselves. Those leaks revealed source code and operational files used to mass-manage compromised WordPress domains. Monitoring from mid-May through late July 2026 found more than **700** stolen-data archives and about **31,000** victim screenshots, while internal logs and exposed systems indicated the campaign hit thousands of IP addresses worldwide, with the highest concentrations in the **United States, Russia, and India**.
Sep 3, 2026