TIKTOUK: Tracing a WordPress Credential Collection Toolkit
ID: fb5673b3-d4bb-5f87-8bfb-dbf1852013c9
STIX ID: report--fb5673b3-d4bb-5f87-8bfb-dbf1852013c9
Feed Name: LevelBlue SpiderLabs Blog
This report documents the TIKTOUK operation: a multi-component toolkit that probes WordPress REST endpoints, retrieves exposed configuration/backups, decrypts plugin-stored SMTP and cloud credentials, and scans client JavaScript for secrets, exfiltrating results to centralized hubs. The analysis reconstructs three components (wp2s_poll.py, wp2s_crack.py, jscrawl-amd64), links observed controller IPs and leaked panels with thousands of credentials, references related WordPress CVEs, and provides IOCs and detection guidance for defenders.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.