Fake WordPress Domain Renewal Email Targeting Admins to Steal Credit Card Data
A phishing campaign is targeting WordPress administrators with fraudulent domain renewal emails designed to steal credit card information and two-factor authentication codes.
A phishing campaign is targeting WordPress administrators with fraudulent domain renewal emails designed to steal credit card information and two-factor authentication codes.
The emails, disguised as legitimate WordPress.com renewal notices, redirect recipients to a fake payment portal where financial data is collected and sent to attackers via Telegram messaging channels.
The phishing attempt begins with an email titled "Renewal due soon – Action required." It uses urgency tactics to prompt immediate action, warning of potential service disruption without specifying a domain name. This generic approach targets multiple organizations.
The email appears professional to bypass spam filters, increasing the likelihood of deceiving recipients who do not scrutinize sender details.
Victims are directed to a fake WordPress payment page hosted on attacker infrastructure. The page replicates the legitimate interface, featuring accurate pricing, VAT calculations, and branded payment method logos.
The email appears professional to bypass spam filters, increasing the likelihood of deceiving recipients who do not scrutinize sender details.
The phishing portal uses a JavaScript form to capture cardholder information, including the cardholder name, card number, expiry date, and CVV. The data is sent via a POST request to a backend script named send_payment.php, which forwards the credentials to attacker-controlled Telegram bots.
A subsequent stage targets two-factor authentication. After card submission, victims encounter a fake 3D Secure verification modal. Users are prompted to enter SMS OTPs, but the process returns a "Verification failed" message, regardless of the OTP's accuracy.
This forces victims to retry, allowing attackers to collect multiple valid OTP codes, which are relayed to Telegram channels through a send_sms.php endpoint.
The campaign employs psychological tactics, such as artificial loading delays, to mimic legitimate banking infrastructure, reducing user suspicion and increasing compliance likelihood.
The attackers utilize Telegram as their primary exfiltration channel, avoiding traditional infrastructure. This method offers advantages such as minimal costs, built-in encryption, and reduced detectability.
Email header analysis shows the campaign originates from theyounginevitables[.]com, relayed through Alibaba Cloud SMTP infrastructure, with a weak DMARC policy offering no spoofing protection.
Organizations should educate administrators to verify renewal notices directly through official WordPress dashboards, avoiding links in emails.
Based on reporting by Cyber Security News.