WooCommerce Admins Targeted by Fake Security Patches That Hijack Sites 
Think you're updating your site security?
You might actually be handing it over to hackers.
- A massive phishing campaign is impersonating WooCommerce with fake “critical patch” emails.
- Victims who install the "patch" unknowingly deploy a hidden backdoor plugin.
- Once infected, attackers create secret admin accounts, install web shells, and gain full control of the website.
Here's how it works:
- Phishing emails spoof real WooCommerce alerts and push users to download a fake update.
- The fake domain uses a homograph attack — swapping a single letter with a lookalike ("ė" instead of "e").
- After installation, cronjobs trigger every minute, allowing attackers to maintain persistence and download more payloads.
The risks are massive:
- Ad injection and redirect attacks
- Card skimming and data theft
- Enlisting your site into DDoS botnets
- Even full ransomware encryption of your store
And the kicker?
The malware hides itself from the plugin list and masks the admin account — making detection extremely difficult.
Patchstack recommends:
- Look for random 8-character admin accounts
- Scan cronjobs for suspicious entries
- Monitor outgoing connections to fake WooCommerce domains
In cybersecurity, even "urgent updates" can be a trap.
Always verify — or risk losing everything.