WP3.XYZ Malware Campaign Compromises Over 5,000 WordPress Sites
A recent malware campaign leveraging the domain wp3.xyz has compromised over 5,000 WordPress sites, adding rogue admin accounts, installing malicious plugins, and exfiltrating sensitive data. Attackers create unauthorized wpx_admin users, granting full access to infected sites. Website owners are urged to audit admin accounts, remove suspicious plugins, block wp3.xyz, and enable multi-factor authentication (MFA) to mitigate risks.
