TIKTOUK: Tracing a WordPress Credential Collection Toolkit

TIKTOUK is a credential collection toolkit targeting WordPress sites. It includes modules that identify WordPress installations, extract exposed configuration files and database credentials, decrypt email credentials from SMTP plugins, and harvest secrets from client-side JavaScript. The toolkit sends all collected data to a centralized controller. Real-world incidents have revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys that could be abused.

• WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)ExploitedVulnerability2026-07-20
• Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt IndicatorsExploitedVulnerability2026-10-01
• NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779ExploitedMalware2026-10-20
• NetScaler ADC en NetScaler Gateway · Kwetsbaarheden VerholpenExploitedVulnerability2026-09-27
• CVE-2026-88771: Citrix NetScaler ADC · Improper Input ValidationCriticalVulnerability2026-09-27