Malware Targets WooCommerce Sites with Malicious Plugins That Steal Credit Card Data

The Wordfence Threat Intelligence Team has uncovered a sophisticated malware campaign targeting WordPress e-commerce sites running the WooCommerce plugin.

This advanced threat masquerades as legitimate WordPress plugins while deploying multi-layered credit card skimming operations to steal customer payment information and administrator credentials.

The malware was first discovered in August 2025 after a Wordfence user submitted a sample for analysis.

Between August 27 and September 9, 2025, Wordfence released four detection signatures to identify these malicious plugins, with premium customers receiving immediate protection and free users receiving access to the signatures after a standard 30-day delay.

Advanced Obfuscation and Persistence Mechanisms

The malicious plugin presents itself with randomly generated names based on three-word combinations, such as “license-user-kit,” “jwt-log-pro,” and “cron-environment-advanced.”

Each installation features uniquely randomized function names and variable identifiers, while text strings are obfuscated via XOR encryption using shared keys. This sophisticated approach helps the malware evade content-based detection systems.

Upon activation, the plugin immediately hides itself from WordPress’s plugin management interface to minimize detection risk. It tracks all users with edit_posts capability (Author role and above) by logging IP addresses and login timestamps in custom database options.

A persistent tracking cookie named “pxcelPage_c01002” ensures continuous user identification across sessions, preventing the delivery of skimming code to privileged users who might discover the infection.

The malware establishes two distinct AJAX-based backdoor endpoints that bypass WordPress authentication entirely. The first endpoint allows attackers to update JavaScript payloads either by setting cookies to specific download URLs or transmitting raw code via POST requests.

The second endpoint enables arbitrary PHP code execution via temporary file creation, granting attackers complete server-level access.

Multi-Tiered Credit Card Skimming Operation

The malware’s skimming infrastructure relies on fake PNG image files containing reversed and custom base64-encoded JavaScript payloads.

Three distinct files serve different purposes: a custom payload deployed via backdoor access, a dynamic payload updated daily from command-and-control servers, and a static fallback payload for redundancy.

Each fake image begins with a legitimate PNG header followed by obfuscated JavaScript code. When users visit WooCommerce checkout pages, the malware injects skimming scripts that attach event listeners to payment forms.

A three-second timeout prevents conflicts with AJAX-based checkout systems, while fake validation routines boost user confidence.

Captured credit card numbers, expiration dates, and CVV codes are exfiltrated through multiple methods, including cURL requests, file_get_contents functions, system-level cURL commands, and email as a final backup.

The campaign demonstrates strong connections to Magecart Group 12 threat actors, evidenced by the “SMILODON” identifier found in command-and-control server URLs.

This connection traces back to 2021 operations, with coding patterns and infrastructure matching the group’s known characteristics. Wordfence’s threat intelligence database now contains over 4.4 million malicious samples, with detection rates exceeding 99% using premium signatures.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates