Hackers Hit WooCommerce Users with Fake Security Updates

A widespread phishing campaign has been targeting WooCommerce administrators globally since April 2025. The operation deceives site owners into installing fraudulent security patches that give attackers full control over their WordPress sites.

Researchers at Patchstack uncovered this operation, which mimics the widely used WooCommerce plugin through emails sent from help@security-woocommerce[.]com. The phishing emails alert recipients to a fictitious vulnerability related to unauthenticated administrative access and pressure them to install a "critical patch" by clicking an embedded button. Victims are then redirected to a counterfeit domain, woocommėrce[.]com, which uses a subtle character swap to appear authentic.

Once the user downloads the file — authbypass-update-31297-id.zip — it installs a malicious plugin that creates a hidden administrator account and connects the compromised site to a remote command server. A cronjob runs every minute to maintain access and download additional payloads, including popular PHP-based web shells like P.A.S.-Form, p0wny, and WSO. These tools enable attackers to inject ads, steal payment data, redirect visitors, launch DDoS attacks, or even deploy ransomware.

To avoid detection, the plugin removes itself from the visible plugin list and conceals the unauthorized admin account it created. It also installs backdoors in the wp-content/uploads/ directory of the infected site, providing attackers with ongoing access even after attempts to clean or restore the system.

According to Patchstack, this campaign bears striking similarities to an earlier operation from late 2023 that also used fake security notifications to compromise WordPress sites. Both campaigns relied on identical types of web shells, techniques for hiding malicious code, and nearly indistinguishable phishing language — suggesting the involvement of either the same threat actor or closely affiliated groups.

The report also urges WooCommerce site owners to examine all administrator accounts for unusual 8-character names, audit scheduled tasks like cronjobs for unfamiliar entries, and monitor outgoing traffic to suspicious domains, including woocommerce-services[.]com and woocommerce-help[.]com. Infected systems may also contain folders named authbypass-update, which should be thoroughly investigated and removed.

Another similar attack occurred just a few months earlier, in July 2023, when WordPress sites — particularly those using WooCommerce — were targeted through a critical vulnerability in the WooCommerce Payments plugin. That campaign also relied on phishing tactics to compromise administrative access, reinforcing the pattern of attackers refining and reusing successful social engineering strategies over time.

Researchers warn that once threat actors are exposed, they tend to adjust their methods to avoid detection. As a result, relying solely on previously known indicators may no longer be sufficient. A comprehensive manual audit of WordPress installations, combined with timely patching using verified updates from official sources, remains essential to securing vulnerable sites.