NEW WORDPRESS MALWARE HIDES ON CHECKOUT PAGES AND IMITATES CLOUDFLARE

Summary from the TLDR InfoSec newsletter

The May 2025 WordPress Core malware campaign, discovered by Wordfence, has three versions: one steals credit card data from checkout pages while mimicking Cloudflare security screens, another hijacks Google Ads and steals login credentials, and the third spreads more malware by replacing website links. Since September 2023, all have been disguised as legitimate plugins and employ advanced anti-detection methods, including hosting management systems on infected sites.