New WordPress Phishing Scam Steals Credit Cards via Telegram

A new phishing campaign targeting WordPress site owners uses fake “domain renewal” notices to steal credit card details and 3-D Secure OTPs, according to Anurag. Victims who click the “Renew Now” button are redirected to a fraudulent payment page on soyfix[.]com that visually mirrors a legitimate WordPress checkout flow, with a Secure order validation banner and branded card logos.

The page collects Cardholder Name, Card Number, Expiry Date and CVV, transmitting them immediately to the attacker, who also prompts for an SMS code via a fake 3-D Secure Verification modal. After submission, the page deliberately returns “Verification failed,” encouraging re-entry of OTPs and enabling the attackers to harvest multiple valid codes.

The back end forwards the stolen credentials to a Telegram bot rather than a conventional server, a C2 exfiltration mechanism described as cheaper and harder to disrupt, according to Anurag. The initial phishing emails were sent from admin@theyounginevitables[.]com, with a domain that had a weak DMARC policy (p=NONE), allowing sender spoofing. WordPress users are advised to verify domain details directly through the official WordPress[.]com dashboard and be sceptical of notices lacking a specified domain name.