WooCommerce admins targeted by fake security patches that hijack sites

A large-scale phishing campaign is impersonating WooCommerce and sending fake 'critical patch' alerts that lead victims to a homograph domain; installing the provided plugin creates hidden admin accounts, persistent cronjobs, and deploys PHP web shells (P.A.S.-Form, p0wny, WSO) allowing full site control, data theft, ad injection, DDoS participation or ransomware; Patchstack observed the operation and published indicators (malicious domains, plugin name, cronjob patterns and upload paths) and remediation suggestions.