Hacked WordPress sites use visitors' browsers to hack other sites

Threat actors are compromising thousands of WordPress sites to inject JavaScript that either drains crypto wallets (AngelDrainer) or coerces site visitors' browsers into executing distributed brute‑force attacks against other WordPress sites via a tasking service (dynamic-linx.com). The campaign abuses injected JS and WordPress XML-RPC to exfiltrate credentials and credentials candidates, has been observed at scale (~1,700+ compromised sites), and uses identifiable domains and script paths as indicators.