Pulse Detail — Threat Intelligence

PULSE NAME

When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation

WHITE PetrP.73 2026-03-11 Modified: 2026-04-10

166

IOCs

HIGH VOLUME

The following in-depth analysis of the most commonly-used CAPTCHA - the code used to secure the registration of a person using a password - has been published: (AS 202412).

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1583.001 T1584.006 T1587 T1588.001 T1608.001 T1608.004 T1189 T1059.001 T1140 T1027.002 T1055 T1497.001 T1497.003 T1555 T1539 T1552 T1071.001 T1132.002 T1573.001 T1104 T1095 T1571 T1102.001 T1041

Indicators of Compromise (5 / 166 total)

All URL domain hostname FileHash-MD5 FileHash-SHA1 FileHash-SHA256

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	0c214872afd60449a5a15876aecc6bf8	MD5 of 09d19e2b98e8eb530855fee8e19e9d5c68c70f558e024dcf82253209668a40ab	2026-03-11
FileHash-MD5	a84a2e52e706c5c88e09eb18801ace50	MD5 of 4a59ea08df0b002d5f9d28ebd778cdd854777ac9bf918469576e00e121586852	2026-03-11
FileHash-MD5	e3c9270e63a497b86255329a79946dcc	MD5 of c8dbd5335dc0828556e6abc2a804121bf65240719a8a3388a5af6b65065a2d5b	2026-03-11
FileHash-MD5	ee191f8bc4942595681ca9a9f2acdbca	—	2026-03-11
FileHash-MD5	fe4a3fb1a48bbdea986e05d1459f925e	MD5 of 50fc22b653a6436825658260c92c3750169622522aa0bf8147fb36a384e85245	2026-03-11

References (1)

↗ https://www.rapid7.com/blog/post/tr-malicious-websites-wordpress-compromise-advances-global-stealer-operation/