GitHub Gaff: 390,000 Credentials Swiped in Sneaky WordPress Scam
The sneaky GitHub repository, “Yet Another WordPress Poster,” was a covert operation by the mysterious threat actor MUT-1244, leading to the exfiltration of over 390,000 WordPress credentials. It turns out it wasn’t just another poster—it was a credential-stealing plot with an npm twist!
Hot Take:
Who knew the road to WordPress fame could lead to a detour of stolen credentials? It seems like “Yet Another WordPress Poster” was more of a “Yet Another Way to Get Hacked” party, with a side of phishing, fake profiles, and a sprinkle of crypto-mining for good measure. Next time, let’s just stick to cat memes, okay?
Key Points:
- GitHub repository “yawpp” was a front for exfiltrating credentials via a malicious npm package.
- Threat actor MUT-1244 used phishing and trojanized repositories to target security researchers.
- Over 390,000 credentials, likely WordPress account details, were stolen.
- The attack involved a fake XML-RPC API tool and malicious payload delivery.
- Phishing emails tricked users into executing a shell command disguised as a kernel update.
Already a member? Log in here