Fallout in wordpress, Aug 24 – Aug 30

What we caught this week while monitoring over 163,411,591 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SATURDAY

Sat Aug 29 · 1 catch · 0 waves · 1 single
micro-behaviors/communicationsmicro-behaviorsobjectives/supply-chainmicro-behaviors/cryptomicro-behaviors/datamicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processobjectivesobjectives/command-and-controlthird_party+2 26d
RS Remote Site Manager 3.3.0 wordpress rootscope-remote-site-manager 1,779 installs 26 days ago

Backdoor detection and data exfiltration

Generic/Callbackwebshell/self-label

FRIDAY

Fri Aug 28 · 1 catch · 0 waves · 1 single
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/libraryobjectives/anti-staticobjectivesobjectives/impactwell-knownobjectives/supply-chainmicro-behaviors/ui+11 27d
Postomatic 1.2.75 wordpress postomatic 2,193 installs 27 days ago

Bundled SweetAlert2 contains region-gated audio/pointer-events sabotage

manipulation/browsersupply-chain/sweetalert2-protestware

THURSDAY

Thu Aug 27 · 2 catches · 0 waves · 2 singles
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/libobjectives/anti-staticobjectivesobjectives/impactwell-knownobjectives/supply-chainmicro-behaviors/ui+11 28d
Postomatic 1.2.74 wordpress postomatic 2,170 installs 28 days ago

Malicious region-gated audio payload

supply-chain/sweetalert2-protestwaremanipulation/browser
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/libobjectives/anti-staticobjectivesobjectives/impactwell-knownobjectives/supply-chainmicro-behaviors/ui+11 28d
Postomatic 1.2.71 wordpress postomatic 2,121 installs 28 days ago

Bundled ransomware in SweetAlert2

supply-chain/sweetalert2-protestwaremanipulation/browser

TUESDAY

Tue Aug 25 · 1 catch · 0 waves · 1 single
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsobjectives/anti-staticobjectives/credential-accesswell-known/librarymicro-behaviors/dataobjectivesobjectives/impactwell-knownmicro-behaviors/ui+7 30d
Conversios – GA4, Google …eed for WooCommerce 7.2.24 wordpress enhanced-e-commerce-for-woocommerce-store 2,791,855 installs 30 days ago

Malicious code in SweetAlert2

manipulation/browsersupply-chain/sweetalert2-protestware

MONDAY

Mon Aug 24 · 1 catch · 0 waves · 1 single
well-known/librarymicro-behaviors/communicationsmicro-behaviorsmicro-behaviors/datamicro-behaviors/osmicro-behaviors/processmicro-behaviors/cryptoobjectivesobjectives/impactwell-knownmicro-behaviors/ui+3 31d
Shipbubble – Shippi…ation for Woocommerce 2.12 wordpress shipbubble 4,380 installs 31 days ago

Bundled protestware payload

manipulation/browserunwanted/sweetalert2-protestware
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories