Hackers Exploit Google Ads to Steal GoDaddy ManageWP Logins
ID: fbafc3e6-b5dd-5498-9ecb-a64ada08f873
STIX ID: report--fbafc3e6-b5dd-5498-9ecb-a64ada08f873
Feed Name: GBHackers
Threat Score
Researchers uncovered a live phishing campaign that purchases spoofed Google Ads for ManageWP, directs users to a cloned login page, and runs an AiTM proxy that relays credentials and one‑time codes to attackers (including exfiltration to Telegram), enabling full account takeover and control of connected WordPress sites; the operation uses a custom, operator‑driven panel and has at least 200 observed victims.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.