Fake WooCommerce of WordPress Patch Installs Backdoor & Web Shells

A brazen, large-scale phishing campaign is exploiting panic among WooCommerce users, duping website administrators into installing a "critical security patch" that hijacks their sites, creates secret backdoors, and plants web shells for long-term control. Discovered by Patchstack researchers, the operation mirrors a 2023 attack but deploys chilling new tactics to evade detection.

A Perfect Storm of Fear and Deception

The attack begins with an email that strikes at the heart of every website owner's fears: a critical vulnerability.

Posing as an urgent security alert from WooCommerce (`help@security-woocommerce[.]com`), the message claims hackers are actively exploiting an “unauthenticated administrative access” flaw. Recipients are urged to download a patch immediately, or risk catastrophic breaches.

Key Red Flags Hidden in Plain Sight:

Spoofed Domain: The link directs to `woocommėrce[.]com`, using a Lithuanian “ė” (U+0117) to mimic the legitimate `woocommerce.com`.
Fabricated Dates: The email references a non-existent vulnerability “discovered” on April 14, 2025, and a scan from April 21, 2025—dates deliberately set in the future to avoid suspicion.
Urgency Overload: Phrases like “urgent measures” and “protect your data” pressure victims to act without scrutiny.

_“This is psychological warfare,” says a Patchstack analyst. “They weaponize trust in brands like WooCommerce to bypass rational judgment.”_

A Malicious Plugin That Disappears

The downloaded file, `authbypass-update-31297-id.zip`, masquerades as a security patch. But once installed, it unleashes a cascade of attacks:

Hidden Cronjob Hijacking: A randomly named cronjob executes every minute, spawning a new admin account with an 8-character randomized username (e.g., `xq9f7zty`).
Silent Backchannel: The plugin pings `woocommerce-services[.]com/wpapi` to fetch a second-stage payload—a heavily obfuscated script.
Web Shell Onslaught: The payload deploys PHP-based shells like P.A.S.-Form, p0wny, and WSO into `wp-content/uploads/`, granting attackers full server control.

Why This Matters: These web shells can:

Steal credit card data from checkout pages.
Redirect users to phishing/scam sites.
Enlist the server in DDoS botnets.
Deploy ransomware to lock owners out.

Worse, the plugin erases itself from the WordPress dashboard and hides the malicious admin account—leaving victims oblivious.

Anatomy of an Attack

(Source: Patchstack)

Stage	Action
1. Phishing Email	Fake WooCommerce alert with “Download Patch” button.
2. Malicious Domain	Homograph `woocommėrce[.]com` mimics the real site.
3. Plugin Installation	Installs cronjob, hidden admin, and fetches payload.
4. Web Shell Deployment	Drops P.A.S.-Form, p0wny, and WSO shells for remote access.
5. Persistence	Self-deletes from plugins list; evades manual audits.

How Attackers Stay Invisible

The campaign’s sophistication lies in its stealth:

Domain Rotation: Payloads are fetched from `woocommerce-services[.]com`, `woocommerce-api[.]com`, or `woocommerce-help[.]com`—domains likely discarded once exposed.
Legacy Code Mimicry: The plugin’s structure resembles legitimate WooCommerce updates to avoid raising flags.
No Trace Left: After installation, the plugin vanishes, forcing admins to hunt for artifacts like cronjobs or hidden folders.

_“This isn’t smash-and-grab,”_ warns Patchstack. _“It’s a silent siege designed to persist undetected for months.”_

Detection & Mitigation

If You’re Affected:

Check for:
Random 8-character admin accounts.
Cronjobs executing `/wp-content/plugins/[random]/includes.php`.
Folders named `authbypass-update`.
Outbound traffic to suspicious domains (e.g., `woocommerce-services[.]com`).
Immediate Steps:
Terminate unrecognized admin accounts.
Scan for web shells in `wp-content/uploads/`.
Audit server logs for unusual GET/POST requests.

Prevention Tactics:

Never Trust Email Links: Manually navigate to official sites for updates.
Homograph Defense: Type domains manually or use bookmarks.
Enable 2FA: Mandate two-factor authentication for all admin accounts.
Backup Relentlessly: Store backups offline to counter ransomware.

A Repeating Threat

This campaign is a sequel to a late-2023 operation that peddled fake patches for a fictional WordPress vulnerability. Both attacks share:

Identical payload-hiding methods.
Overlapping web shell toolkits.
Near-identical email templates.

_“These actors are iterating,”_ says Patchstack. _“They learn from past campaigns to refine their social engineering.”_

As phishing campaigns grow more polished, the line between legitimate alerts and lethal traps blurs. For WooCommerce’s 5+ million users, this attack is a wake-up call: assume every email is guilty until proven innocent.

“Cybersecurity isn’t about tools—it’s about habits,” says a Patchstack spokesperson. “Slow down. Verify. Question urgency. That’s how you break the chain.”

Stay vigilant. Share this article with your network. For real-time updates, follow [Your Publication] on Twitter/X and subscribe to our Threat Intel newsletter.

Fake WooCommerce of WordPress Patch Installs Backdoor & Web Shells

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence