New Malware Infects WooCommerce Sites Through Fake Plugins to Steal Credit Card Data

A sophisticated malware campaign is actively targeting WordPress e-commerce websites using the WooCommerce plugin, according to Wordfence Threat Intelligence Team. The campaign disguises itself as a legitimate WordPress plugin with randomly generated names and then secretly steals credit card information from shoppers, with the malware’s randomised function names and obfuscated text helping it evade detection.

Examples of plugin names include “license-user-kit,” “jwt-log-pro,” “cron-environment-advanced,” and “access-access-pro,” while the backdoors create multiple AJAX-based endpoints for remote updates and PHP code execution. The campaign first came to light when a Wordfence user submitted a malware sample on 21 August 2025, leading to four detection signatures released between 27 August and 9 September 2025.

Security researchers note the malware uses cookies to track privileged users, stores credentials in cookies, and hides its JavaScript payloads inside fake PNG files, with three payload types to ensure continued operation. There is strong evidence linking the campaign to Magecart Group 12 via the SMILODON identifier, with related C2 URLs on the IP 121.127.33[.]229.