Security researchers have analyzed TIKTOUK, a credential collection toolkit targeting WordPress websites and exposed JavaScript files.
A leaked control panel examined by analyst Leon Cottrell showed approximately 50,000 server-side credentials across 37,000 domains, indicating an operation already running at scale.
The findings included hundreds of AWS keys that the attackers had validated as live. These credentials could support abuse involving Amazon SES, EC2, and Bedrock services. Separate incident telemetry linked payload downloads and controller communications to 31.56.58[.]59.
TIKTOUK combines two Python scripts with a Linux crawler written in Go. Each component receives tasks from a central HTTP hub and sends collected information back.
Researchers used source review, reverse engineering, and controlled tests to establish how the components work.
TIKTOUK Harvests WordPress Credentials
The first script, wp2s_poll.py, fetches website pages to identify WordPress installations and searches page content for secret patterns.
It also sends REST batch requests containing the malformed path http://:, alongside requests targeting category deletion and paragraph rendering routes.
When JSON requests received HTTP 403 responses, the script retried with multipart encoding and received HTTP 200 responses. This change gives defenders a useful pattern to investigate, although response codes alone do not prove successful exploitation.
The second script, wp2s_crack.py, retrieves exposed files, including wp-config.php.bak, .env, .git/config, backup.sql, and wp-content/debug.log. These files can reveal database passwords, WordPress security keys, cloud credentials, and application settings.
It also sends nested REST batch requests containing author_exclude and UNION ALL SELECT expressions to request database option values. Returned hexadecimal data is decoded into readable text for further processing.
Researchers identified credential recovery routines for WP Mail SMTP, Easy WP SMTP, and FluentSMTP. These routines use available keys or WordPress configuration material to decrypt stored email credentials.
The toolkit does not break the encryption algorithms; it exploits access to the information needed for decryption.
The Go component, jscrawl-amd64, downloads referenced JavaScript files and scans their contents. Its findings included SendGrid, Anthropic, and Bedrock token patterns, plus AWS-shaped credential pairs. Collected results reach the hub through /v1/ingest and /api/crack/report.
The request structures resemble two disclosed WordPress weaknesses: CVE-2026-60137, involving SQL injection through author__not_in, and CVE-2026-63030, involving REST batch-route confusion.
WordPress advisories explain that combining these weaknesses can enable remote code execution. Fixes include versions 6.9.5 and 7.0.2; the SQL injection issue also affects the 6.8 branch, patched in 6.8.6.
However, the controlled tests did not demonstrate successful exploitation of either vulnerability. The simulated targets returned prepared responses without executing SQL, so these tests establish toolkit behavior rather than confirmed website compromise, levelblue said.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45 | wp2s_poll.py — WordPress probing component |
| SHA-256 | 0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02 | wp2s_crack.py — Credential collection and recovery compon |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
