6 minhigh
TIKTOUK: Tracing a WordPress Credential Collection Toolkit
TIKTOUK toolkit probes WordPress sites, steals exposed configs, decrypts SMTP credentials, and scans JavaScript for API keys; leaked panel shows 50k stolen credentials across 37k domains. TIKTOUK is a multi-component credential theft toolkit targeting WordPress sites. Its Python probes identify WordPress installations via REST API batch requests, then retrieve exposed configuration files and decrypt SMTP plugin credentials using recovered WordPress keys. A Go binary scans JavaScript for API tokens. Real-world telemetry confirms active deployment with approximately 50,000 stolen credentials across 37,000 domains.
Sens:■ ImmediateConf:
IOCs11
3ip3sha2562cve2filename1sha1
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block IPs 31.56.58.59, 193.32.162.134, 195.178.110.209 at perimeter
- Update WordPress to 6.9.5+ or 7.0.2+ immediately
- Hunt for wp2s_poll.py, wp2s_crack.py, jscrawl-amd64 in environment
- Rotate SMTP and AWS credentials if WordPress config was exposed
Key Takeaways
- Three components: two Python scripts and one Go binary share a central HTTP hub for tasking and reporting
- wp2s_crack.py decrypts WP Mail SMTP, Easy WP SMTP, and FluentSMTP settings using recovered WordPress keys
- Leaked panel contained ~50k credentials across ~37k domains with hundreds of validated AWS keys
- CVE-2026-60137 and CVE-2026-63030 affect WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2
- Related Golang botnet binary with remote command execution capability identified alongside TIKTOUK panels
Attack Chain
- Reconnaissance: wp2s_poll.py probes WordPress REST batch routes and classifies targets
- Collection: wp2s_crack.py retrieves wp-config.php.bak, .env, .git/config, backup.sql, and debug.log
- Credential Recovery: Decrypts WP Mail SMTP, Easy WP SMTP, and FluentSMTP settings using recovered keys
- Secret Scanning: jscrawl-amd64 fetches and scans JavaScript files for API keys and tokens
- Exfiltration: Components submit collected credentials and secrets to central hub via HTTP API endpoints
- Command and Control: Golang botnet binary enables remote command execution on compromised hosts
Affected Systems
- WordPress 6.9.x releases before 6.9.5
- WordPress 7.0.x releases before 7.0.2
- WP Mail SMTP plugin
- Easy WP SMTP plugin
- FluentSMTP plugin
- Linux systems targeted by jscrawl-amd64
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-60137 | WordPress WP_Query | High | Insufficient sanitization of author__not_in parameter enables SQL injection. |
| CVE-2026-63030 | WordPress REST batch routing | Critical | REST batch-route confusion combinable with SQL injection for RCE. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Python script and Go binary execution visible; HTTP activity may blend with legitimate web traffic. |
| Network Visibility | High | Distinctive REST batch request patterns and exposed file retrieval paths are identifiable in web logs. |
| Detection Difficulty | Moderate | Distinctive request patterns exist but multipart retry and legitimate-looking file requests require correlation. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| REST batch requests containing malformed http://: path with DELETE on /wp/v2/categories/0 indicate TIKTOUK probing (T1595.002) | Web server access logs, WAF logs | Reconnaissance | Low — malformed path is highly anomalous |
| Sequential requests for wp-config.php.bak, .env, .git/config, backup.sql from same host indicate credential harvesting (T1552.001) | Web server access logs, HTTP proxy logs | Collection | Low — backup file requests are abnormal |
| HTTP POST submissions to /v1/ingest or /api/crack/report endpoints indicate TIKTOUK data exfiltration (T1041) | EDR network telemetry, HTTP proxy logs | Exfiltration | Low — endpoint paths are toolkit-specific |
| Python processes making outbound HTTP requests to known TIKTOUK C2 IPs indicate active toolkit operation (T1071.001) | EDR process network telemetry | Command and Control | Medium — Python HTTP clients are common |
Required Log Sources
- Web server access logs
- EDR process execution logs
- HTTP proxy logs
- DNS resolution logs
- WordPress application logs
- Network firewall logs
Key Behavioral Indicators
- REST batch requests containing malformed http://: path
- DELETE requests to /wp/v2/categories/0 endpoint
- POST requests to /wp/v2/block-renderer/core/paragraph
- JSON requests retried as multipart after HTTP 403
- Requests for wp-config.php.bak, .env, .git/config, backup.sql
- HTTP submissions to /v1/ingest or /api/crack/report
Control Gaps
- WAF rules may not block multipart-encoded REST batch retries
- Web server may serve .bak and .env files without restriction
- REST API batch routing may be enabled by default without monitoring
- SMTP plugin encrypted settings accessible via database option extraction
- JavaScript files with embedded API tokens not scanned at serve time
False Positive Assessment
Low — REST batch requests with malformed http://: path and sequential backup file requests are highly anomalous in normal traffic.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block web access to wp-config.php.bak, .env, .git/config, backup.sql
- Disable WordPress REST API batch routing if not required
- Enforce WAF rules blocking SQL injection in REST parameters
- Monitor and block outbound connections to /v1/ingest and /api/crack/report
User Protection
- Audit WordPress admin accounts for unauthorized changes
- Review SMTP plugin settings for tampered credentials
- Scan served JavaScript files for exposed API keys and tokens
- Deploy EDR detection for Python scripts making outbound HTTP requests
Security Awareness
- Enforce policies prohibiting wp-config.php.bak and .env in web roots
- Train development teams on secure credential storage practices
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
Attackers built a toolkit called TIKTOUK that automatically finds WordPress websites, steals their configuration files, and decrypts email passwords stored in WordPress plugins. The toolkit also scans website code for cloud service keys and API tokens. A leaked control panel showed about 50,000 stolen credentials from 37,000 websites. Organizations running WordPress should update to the latest version, check for exposed configuration files, and rotate any credentials that may have been stolen.
Additional IOCs
- File Paths:
wp2s_poll.py- WordPress probing component dropped on victim hostswp2s_crack.py- Credential collection component dropped on victim hostsjscrawl-amd64- Go-based JavaScript secret scanner for Linux
- Other:
/v1/ingest- C2 API endpoint for probing and JS scanner data submission/api/crack/report- C2 API endpoint for credential collection component reporting
Showing defanged values
- cveCVE-2026-60137Insufficient sanitization of author__not_in parameter enables SQL injection.
- cveCVE-2026-63030REST batch-route confusion combinable with SQL injection for RCE.
- filenamewp2s_crack.pyCredential collection component dropped on victim hosts
- filenamewp2s_poll.pyWordPress probing component dropped on victim hosts
- ip193[.]32[.]162[.]134TIKTOUK C2 panel serving tasks and receiving data
- ip195[.]178[.]110[.]209Additional TIKTOUK C2 panel identified during investigation
- ip31[.]56[.]58[.]59Payload host and C2 controller for TIKTOUK components
- sha19903f4576980ff7cfd560ca57c665a4b59b3c30dSHA1 of Golang botnet binary with RCE capability
- sha2560d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02SHA-256 of wp2s_crack.py credential collection component
- sha2561e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90SHA-256 of jscrawl-amd64 JavaScript secret scanner
- sha256c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45SHA-256 of wp2s_poll.py WordPress probing component