Winnti Hackers Steal 390,000 WordPress Credentials with Glutton Malware Targeting PHP Frameworks in China, US, and More

A yearlong supply-chain attack has been uncovered, resulting in the theft of over 390,000 WordPress credentials. This attack, attributed to the Winnti hacking group, has utilized a new PHP-based backdoor known as Glutton. The malware exploits popular PHP frameworks, including Laravel and ThinkPHP, and has been reported to target not only benign security personnel but also other cybercriminals. The attack has affected regions including China, the United States, Cambodia, Pakistan, and South Africa, highlighting the increasingly complex landscape of cyber threats where hackers are now targeting each other. The Glutton malware is part of APT41's toolkit and is causing significant disruptions in the cybersecurity community.