New Malicious WordPress Plug-In Turns E-Commerce Sites into Phishing Pages: The Rise of PhishWP

PhishWP: Malicious WordPress Plugin Turns E-Commerce Sites into Phishing Machinery

Cybersecurity researchers have uncovered a malicious plugin dubbed "PhishWP" that is exploiting WordPress sites to create sophisticated phishing pages that masquerade as reliable online payment processes. Discovered on a Russian cybercrime forum, the plugin targets unsuspecting customers by mimicking trusted e-commerce applications like Stripe, effectively siphoning sensitive payment information from users.

According to findings published by SlashNext this week, PhishWP is designed to be highly deceptive, incorporating features that allow it to duplicate legitimate payment flows. Notably, it generates one-time passwords (OTPs) during transactions, enhancing the illusion of security and trustworthiness. Victims, believing they are engaging with a legitimate payment gateway, unwittingly enter their credit card details, expiration dates, and CVVs, only for this sensitive information to be transmitted directly to a Telegram account controlled by cybercriminals.

SlashNext security researcher Daniel Kelley highlighted how PhishWP’s counterfeit checkout pages can look remarkably authentic, causing users to feel confident in their transactions. The plugin not only captures payment information but also gathers additional data such as IP addresses and screen resolutions, creating detailed profiles for future fraudulent activities.

Further complicating prevention efforts, PhishWP can be easily installed on either compromised legitimate sites or entirely fraudulent ones. Its capacity for auto-generating fake order confirmations extends the window of deception, allowing attackers to delay detection until it’s too late.

As cybercriminals increasingly turn to malicious WordPress plugins, the potential for devastation grows. SlashNext advocates for browser-based phishing protection solutions to combat such threats, offering users a vital line of defense against these evolving tactics.