A widespread phishing campaign has been targeting WooCommerce administrators globally since April 2025. The operation deceives site owners into installing fraudulent security patches that give attackers full control over their WordPress sites. Researchers at Patchstack uncovered this operation , which mimics the widely used WooCommerce plugin through emails sent from help@security-woocommerce[.]com . The phishing emails alert recipients to a fictitious vulnerability related to unauthenticated administrative access and pressure them to install a "critical patch" by clicking an embedded button. Victims are then redirected to a counterfeit domain, woocommėrce[.]com , which uses a subtle character swap to appear authentic. Once the user downloads the file — authbypass-update-31297-id.zip — it installs a malicious plugin that creates a hidden administrator account and connects the compromised site to a remote command server. A cronjob runs every minute to maintain access and d...