Russian hackers turn trusted online stores into phishing pages

Share:

The PhishWP WordPress plugin is well-equipped to turn legitimate shopping sites into phishing pages that capture sensitive payment and browser details.

In a smart campaign, Russian cybercriminals are turning trusted online stores into phishing pages that capture sensitive details through convincing payment interfaces.

According to a research by the cybersecurity firm Slashnext, the Russian miscreants have built a WordPress plugin, PhishWP, which creates fake payment pages that look like trusted services, such as Stripe.

“WordPress is one of the most popular web application publishing platforms that is easy to customize via plugins,” said Mayuresh Dani, manager of security research at Qualys Threat Research Unit. “Consumers and administrators alike are familiar with the WordPress interface, which makes plugins such as PhishWP a higher risk.”

According to SlashNext, information at risk includes credit card number, expiration date, CVV, billing address, and browser metadata.

Telegram for faster exfiltration

PhishWP integrates with Telegram, instantly transmitting stolen data to attackers once a victim presses “enter,” SlashNext noted in a blog post, accelerating and enhancing the efficiency of phishing attacks.

“As soon as a user enters their payment details, the plugin transmits that information directly to the attacker, via instant messaging platforms like Telegram,” said Jason Soroko, senior fellow at Sectigo. “This immediate forwarding of information equips cybercriminals with the necessary credentials to make fraudulent purchases or resell the stolen data—sometimes within minutes of capturing it.”

Attackers can either hack legitimate WordPress websites or create fake ones to install the plugin. Once set up to look like a payment gateway, it tricks users into entering their payment information.

The plugin was reportedly found to be distributed on a Russian cybercrime forum.

Advanced OTP theft

The research also revealed an added potential for the plugin to be used for more advanced theft leading to fake transactions.

According to SlashNext findings, PhishWP employs advanced tactics, such as stealing the OTP sent during a 3D Secure (3DS) check. By capturing this code, attackers can impersonate users, making their fraudulent transactions appear legitimate.

“With the OTP in hand, cybercriminals bypass one of the most critical safeguards in digital transactions, making their fraudulent activities look alarmingly legitimate to both banks and unwitting shoppers,” Soroko said.  “Many people have been trained to believe that one-time passcodes (OTP) help a system to be more secure, but in this case, they are merely handing over the keys to their adversary.”

Other key features offered with the plugin include customizable checkout pages, auto-response emails, multi-language support, and obfuscation options.

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
9:41 am, Jan 15, 2025
weather icon 9°C
L: 9° | H: 10°
mist
Humidity: 92 %
Pressure: 1034 mb
Wind: 2 mph W
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 5 km
Sunrise: 7:59 am
Sunset: 4:20 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
9° | 10°°C 0 mm 0% 3 mph 98 % 1034 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
5° | 9°°C 0 mm 0% 5 mph 96 % 1035 mb 0 mm/h
Fri Jan 17 9:00 pm
weather icon
3° | 7°°C 0 mm 0% 4 mph 93 % 1036 mb 0 mm/h
Sat Jan 18 9:00 pm
weather icon
2° | 7°°C 0 mm 0% 3 mph 89 % 1033 mb 0 mm/h
Sun Jan 19 9:00 pm
weather icon
2° | 6°°C 0 mm 0% 4 mph 89 % 1024 mb 0 mm/h
Today 12:00 pm
weather icon
9° | 9°°C 0 mm 0% 2 mph 90 % 1034 mb 0 mm/h
Today 3:00 pm
weather icon
9° | 9°°C 0 mm 0% 3 mph 90 % 1033 mb 0 mm/h
Today 6:00 pm
weather icon
7° | 7°°C 0 mm 0% 3 mph 97 % 1034 mb 0 mm/h
Today 9:00 pm
weather icon
6° | 6°°C 0 mm 0% 3 mph 98 % 1034 mb 0 mm/h
Tomorrow 12:00 am
weather icon
6° | 6°°C 0 mm 0% 3 mph 96 % 1034 mb 0 mm/h
Tomorrow 3:00 am
weather icon
5° | 5°°C 0 mm 0% 3 mph 95 % 1033 mb 0 mm/h
Tomorrow 6:00 am
weather icon
5° | 5°°C 0 mm 0% 3 mph 96 % 1034 mb 0 mm/h
Tomorrow 9:00 am
weather icon
5° | 5°°C 0 mm 0% 3 mph 96 % 1034 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€94,040.72
0.18%
Ethereum(ETH)
€3,121.85
-0.87%
XRP(XRP)
€2.76
10.54%
Tether(USDT)
€0.97
-0.01%
Solana(SOL)
€182.49
-0.68%
Dogecoin(DOGE)
€0.346699
1.41%
USDC(USDC)
€0.97
0.01%
Shiba Inu(SHIB)
€0.000020
-0.86%
Pepe(PEPE)
€0.000016
-1.24%
Peanut the Squirrel(PNUT)
€0.54
-8.85%
Scroll to Top