390,000 WordPress Credentials Leaked in Phishing Attack

Major WordPress Credential Compromise: Over 390,000 Accounts Affected

In a shocking revelation, a year-long supply chain attack has compromised more than 390,000 credentials associated with WordPress sites. This sophisticated attack, identified by Datadog Security Labs, primarily targeted academic researchers through a phishing campaign and exploited trojanized GitHub repositories featuring fake proof-of-concept (POC) exploits. As the WordPress platform supports over 800 million sites, this incident highlights significant vulnerabilities in software security, particularly affecting security professionals and researchers.

Understanding the MUT-1244 Attack

The attack, dubbed MUT-1244, stands for "Mysterious Unattributed Threat," and has raised alarms within the cybersecurity community. While it only represents a fraction of the total WordPress sites, its impact is profound, particularly as it has affected security experts, penetration testers, and unauthorized parties who obtained the credentials through nefarious means.

• Key Findings from Datadog Security Labs:
  • Hundreds of victims are still being compromised.
  • Sensitive information, including SSH private keys and Amazon Web Services (AWS) access keys, has been exfiltrated.

The Mechanism Behind the Attack

According to Jason Soroko, a senior fellow at Sectigo, the attackers orchestrated a scheme involving dozens of GitHub repositories that masqueraded as legitimate POC exploits. Security professionals and red teamers, unaware of the malicious intent, inadvertently installed these harmful second-stage payloads, leading to the theft of critical credentials and keys.

• Critical Insights:
  • The attackers employed phishing tactics, tricking targets into installing a fake kernel update.
  • Trojanized repositories often appeared in trusted threat intelligence feeds, making them seem credible.

Supply Chain Vulnerabilities

Itzik Alvas, co-founder and CEO of Entro Security, emphasized that the MUT-1244 attackers compromised various enterprises’ code supply chains by creating repositories with names that seemed legitimate and functional. These repositories became dependencies for many developers, often bundled with a trojanized password checker that captured user passwords during input.

• The Long-Lasting Impact:
  • The attack has remained undetected for a year, leading to an estimated 390,000 compromised credentials.

Protecting Against Future Attacks

Stephen Kowski, Field CTO at SlashNext Email Security, pointed out that this campaign specifically targeted the software development pipeline by corrupting widely-used libraries and tools. The malicious code poses a risk of spreading to numerous downstream applications once installed.

• Preventive Measures:
  • Teams must thoroughly examine all code, even from trusted sources.
  • Utilizing advanced threat detection tools can help identify malicious code patterns and suspicious behaviors in real-time.
  • Automated security scanning solutions are essential for analyzing dependencies and detecting potential threats before they infiltrate the software supply chain.

Conclusion: Staying Vigilant in Cybersecurity

The MUT-1244 attack serves as a stark reminder of the vulnerabilities inherent in our digital infrastructure, especially within the WordPress ecosystem. As cyber threats continue to evolve, it is crucial for organizations to enhance their security measures and remain vigilant.

What are your thoughts on this significant security breach? Share your insights in the comments below, and for more information on cybersecurity best practices, check out our related articles on protecting your online assets.

For further reading, consider visiting Datadog’s official blog or Sectigo’s resources.