Malicious WordPress Plugin Assists in Phishing Attacks

Researchers warn that attackers are leveraging a WordPress plugin called PhishWP to set up or compromise sites that mimic legitimate payment processors, capturing credit card numbers, CVVs, billing addresses and 3D Secure OTPs and sending the harvested data to attackers (commonly via Telegram) in real time; victims receive fake confirmation messages while fraud is perpetrated.