Researchers find a yearlong ongoing supply-chain attack targeting malicious and benevolent security personnel and stealing over 390K WordPress credentials
arstechnica.com/security/202... Forums: news.ycombinator.com : Yearlong supply-chain attack targeting security pros steals 390K credentials r/technology : Yearlong supply-chain attack targeting security pros steals 390K credentials r/espionage : Yearlong supply-chain attack targeting security pros steals 390K credentials | Multifaceted, high-precision campaign targets malicious and benevolent hackers alike. BeauHD / Slashdot : Yearlong Supply-Chain Attack Targeting Security Pros Steals 390,000 Credentials Ars OpenForum : Yearlong supply-chain attack targeting security pros steals 390K credentials
Context & Ripple Effects
This report extends a recurring supply-chain risk in the WordPress ecosystem: earlier coverage found backdoors in AccessPress themes and plugins, showing how a compromised distribution channel can turn trusted software into an access path.
It also follows reports that an open-source ecosystem flaw enabled breaches at dozens of companies. Here, the targets include security personnel themselves, making the security-tool and research community part of the exposure chain rather than only its responder.
First-order effects
- More than 390,000 WordPress credentials have been exposed, creating an immediate account-security problem for the affected credential holders and the sites tied to those accounts.
- Security professionals targeted by the campaign must treat the software supply paths involved as compromised until their credentials, sessions, and toolchains can be reviewed.
Second-order effects
- WordPress operators and security teams will need to prioritize credential rotation and access review, especially where affected accounts hold administrative privileges.
- The campaign raises the cost of trusting tools and packages used by researchers and defenders, because compromise of those users can provide attackers with downstream access to customer or community systems.
Third-order effects
- If campaigns increasingly target the security community through its dependencies, software provenance and credential isolation become core controls for defenders—not merely safeguards for application developers.
- The broader shift is toward supply-chain attacks that seek privileged intermediaries: one compromised tool or researcher can create access opportunities across many separate organizations.
The trend: This is part of the expanding dual-use software-supply-chain threat, in which the same ecosystems that enable security work can be used to reach high-value defensive and operational credentials.