Tia N.List

CTI · reviewed · 2026-10-03

TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks

Full story & timeline

Actors

—

Malware / tools

TIKTOUK

Campaigns

—

CVEs

CVE-2026-60137CVE-2026-63030

Victim sectors

cross-sector

Geography

global

MITRE ATT&CK

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: TIKTOUK WordPress Credential Collection Toolkit - Batch Probe, Exposed File Harvesting and Hub Reporting
id: 336d459a-2bba-4f87-8e99-292b8fb23a2e
status: experimental
description: "Detects web request patterns attributed to the TIKTOUK WordPress credential-collection toolkit - malformed REST batch-route probes carrying the http://: path, UNION ALL SELECT payloads against WP_Query, fetches of the exposed configuration file set the collector pulls (wp-config.php.bak, .env, .git/config, backup.sql, wp-content/debug.log), and worker submissions to the toolkit hub endpoints /v1/ingest and /api/crack/report."
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit
author: Tia N. List
date: 2026-10-03
tags:
  - attack.t1595
  - attack.t1552
  - attack.t1555
  - attack.t1119
  - attack.t1071
logsource:
  category: webserver
detection:
  selection_batch_probe:
    cs_uri|contains:
      - 'http://:'
      - 'http%3A%2F%2F%3A'
  selection_sqli_payload:
    cs_uri|contains:
      - 'UNION ALL SELECT'
  selection_exposed_file:
    cs_uri|contains:
      - 'wp-config.php.bak'
      - '/.env'
      - '/.git/config'
      - 'backup.sql'
      - 'wp-content/debug.log'
  selection_hub_report:
    cs_uri|contains:
      - '/v1/ingest'
      - '/api/crack/report'
  condition: selection_batch_probe or selection_sqli_payload or selection_exposed_file or selection_hub_report
falsepositives:
  - Routine vulnerability scanners probing WordPress sites for exposed backup and environment files
  - Legitimate WordPress administration or migration tooling requesting the same backup files
level: medium

YARA-X raw

rule TIKTouk_WordPress_Credential_Harvester {
    meta:
        author = "Tia N. List"
        date = "2026-10-03"
        status = "experimental"
        description = "TIKTOUK WordPress credential-collection toolkit components: the Python workers wp2s_poll.py and wp2s_crack.py and the stripped Go crawler jscrawl-amd64 pull targets from a central HTTP hub, probe WordPress REST batch routes, harvest exposed configuration files, and report back to /v1/ingest or /api/crack/report. Derived from case analysis (LevelBlue SpiderLabs) - NOT validated against a live sample."
        reference = "https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit"
        falsepositives = "Vulnerability scanners and WordPress administration scripts referencing the same exposed-file paths or REST routes; require multiple toolkit markers before acting"
    strings:
        $toolkit_poll = "wp2s_poll.py" ascii nocase
        $toolkit_crack = "wp2s_crack.py" ascii nocase
        $toolkit_crawler = "jscrawl-amd64" ascii nocase
        $hub_ingest = "/v1/ingest" ascii
        $hub_report = "/api/crack/report" ascii
        $probe_batch = "http://:" ascii
        $probe_route = "wp/v2/block-renderer/core/paragraph" ascii
        $harvest_config = "wp-config.php.bak" ascii nocase
        $harvest_debug = "wp-content/debug.log" ascii nocase
    condition:
        any of ($toolkit*)
        or
        (
            any of ($hub*)
            and any of ($probe*)
            and any of ($harvest*)
        )
}

References

Source on GitHub