A WordPress plugin known as PhishWP, has been discovered on Russian cybercrime forums and is being exploited by cybercriminals to steal sensitive data from unsuspecting users.
The plugin, capable of mimicking legitimate payment pages like Stripe, is either installed on compromised websites or fraudulent ones set up by attackers, according to a report from Slashnext.
PhishWP enables criminals to collect credit card numbers, CVVs, billing addresses and even one-time passwords (OTPs) used for 3D secure checks.
Victims are tricked into entering their personal and payment details on these fake checkout pages, which are then transmitted to attackers in real time via Telegram.
The stolen data is used for unauthorized transactions or sold on the dark web.
The report noted plugin’s advanced features make it particularly dangerous, offering customizable payment pages that convincingly simulate trusted services, support multiple languages for global campaigns, and obfuscate its source code to evade detection.
Other features include browser profiling, fake order confirmation emails and OTP harvesting, which further enhance its effectiveness.
Attackers use PhishWP by either infiltrating trusted WordPress sites or setting up fraudulent ones. They attract victims through phishing emails, social media ads, or search engine manipulation.
Once victims input their payment information, PhishWP immediately relays the data to attackers while sending fake confirmation emails to delay suspicion.
To compromise a user’s information, a threat actor copies the payment interface of a known service to lure unsuspecting users to a webpage.
Once the user types in their payment information, all their information is instantaneously sent to a threat actor via Telegram.
Data such as the user’s IP address and browser information is also sent across along with their credit card information.
To make sure that the attackers have time to use the stolen information, the plugin also includes functionality that sends a confirmation email to victims with their order details.
Mayuresh Dani, manager, security research at Qualys Threat Research Unit, noted WordPress is one of the most popular web application publishing platforms that is easy to customize via plugins.
“Consumers and administrators alike are familiar with the WordPress interface, which makes plugins such as PhishWP a higher risk,” he said.
Beyond the initial data grab, PhishWP also employs more sophisticated techniques by hijacking the 3D Secure (3DS) verification process.
Dani explained in cases where users have enabled 3DS code requests, the plugin also includes a 3DS Code Popup to make sure that this information is also siphoned off to the threat actor.
“In my opinion, this functionality makes PhishWP a highly successful information stealer – as long as the victims enter valid information,” he said.
Jason Soroko, a senior fellow at Sectigo, pointed out that normally, a short code (OTP) is sent to the cardholder’s phone or email, serving as an extra layer of proof that the person making the purchase is the actual cardholder.
However, PhishWP intercepts or tricks users into entering this code on the phony checkout page, enabling attackers to complete transactions as if they were fully authorized.
“With the OTP in hand, cybercriminals bypass one of the most critical safeguards in digital transactions, making their fraudulent activities look alarmingly legitimate to both banks and unwitting shoppers,” he said.
He added many people have been trained to believe that one-time passcodes (OTP) help a system to be more secure, but in this case, they are merely handing over the keys to their adversary.
