Security researchers have uncovered a large-scale phishing operation targeting WooCommerce users with fake security alerts. The campaign tricks victims into downloading what appears to be a “critical patch” but actually installs a backdoor on their websites.

According to WordPress security firm Patchstack, this sophisticated attack resembles a similar campaign from December 2023 that used fake CVE notifications to compromise WordPress sites. The identical tactics suggest either the same threat actor or a close imitator is behind this new wave.

“They claim the targeted websites are impacted by a (non-existent) ‘Unauthenticated Administrative Access’ vulnerability, and they urge you to visit their phishing website,” explains security researcher Chazz Wolcott.

The attack works by:

1. Sending emails urging recipients to download a security patch
2. Redirecting victims to a spoofed WooCommerce Marketplace using an IDN homograph attack (using “woocommėrce.com” with a modified “e”)
3. Delivering a malicious ZIP file disguised as a legitimate plugin update

Once installed, the malware:
– Creates a hidden administrator account with randomized credentials
– Establishes a cron job that runs every minute
– Communicates with external command servers
– Downloads additional obfuscated payloads
– Deploys multiple web shells (P.A.S.-Fork, p0wny, WSO)
– Conceals itself from the plugin list

Compromised websites can be used for spam injection, malicious redirects, DDoS attacks via botnet recruitment, or even ransomware deployment.

Website owners should scan for suspicious plugins or administrator accounts and ensure all software is current with legitimate updates.