CloudSEK Finds AI-Agent-Driven Campaign Behind 12,000 WordPress Backdoors and Crypto Theft

Aug 19, 2026 · Original article ↗

Summary

CloudSEK traced mass WordPress compromises, crypto theft, and cryptojacking to an operator using AI coding agents. An exposed directory revealed the operation; its blockchain C2 project was tested locally but never deployed.

Key points

An unauthenticated directory listing exposed the operator’s working files, including agent transcripts, reconnaissance data, tools, and stolen material.
The operator used AI coding agents in full-auto mode, disabling approval safeguards and tasking them through Telegram with reused fake-authorization prompts.
A WordPress-to-webshell pipeline produced 12,048 backdoor records across 8,996 sites; separate files contained 66 sets of harvested database admin credentials.
The operator held wallet keys and recovery phrases scraped without authentication from a third-party phishing network’s misconfigured database. The report says these wallets should be treated as compromised.
Evidence also included validated API keys and admin tokens, exposed customer and financial data, and a Monero miner deployed on compromised hosts.
The operator developed a blockchain-based command-and-control prototype, but CloudSEK found evidence it was only tested locally and never deployed on a live chain.
CloudSEK recommends rotating exposed credentials, moving API keys out of client-side code, securing public data stores, sweeping affected wallets to new keys, and retaining human approval controls for AI agents.

Article Details

Attack Vectors: Automated exploitation of WordPress sites through a WordPress-to-webshell pipeline, creating attacker-controlled administrator accounts.
Credential access through harvested WordPress database credentials, secrets scraped from client-side bundles, and unauthenticated reads of exposed cloud databases.
Targeted compromise of crypto and DeFi organisations, including an authentication bypass against a trading-bot backend that exposed encrypted wallet keys.
Scraping seed phrases and wallet keys from a third-party phishing network's publicly readable Firestore database; the article says these were phishing victims' wallets, not a breach of the legitimate upstream product.
Cryptojacking through a disguised Monero miner deployed to compromised hosts and run in the background.
Remote-code-execution reconnaissance using a fastjson2 deserialization kit; the article reports no successful code execution from this activity.
Use of Telegram to task and monitor AI coding agents configured for unattended offensive activity.
Defensive Notes: Rotate potentially exposed credentials, API keys, SSH keys, and tokens; invalidate captured admin and session tokens, and scope API keys.
Treat affected wallets as compromised and move funds to freshly generated keys.
Disable internet-facing directory listings and require authentication for cloud databases and object storage; audit Firestore, S3, and equivalent stores for public access.
Keep human approvals enabled for AI agents, avoid blanket permission-bypass flags, constrain sub-agent auto-approval, and monitor for fake authorized-target prompts and full-auto configurations.
Move RPC and analytics API keys embedded in client-side bundles to server-side storage.
If the DeadDropC2 design or a derivative is deployed, monitor for interactions with its identified wallet addresses, matching contract bytecode and event signatures, and periodic getStatus() calls to the listed BSC testnet RPC endpoints.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]236[.]54[.]207`	Sister host attributed to the operator, with an identical open-directory setup previously exposed on port 18080 and an LLM proxy on port 7070.
IPV4	`165[.]154[.]152[.]47`	Cloud VPS referenced in shell history and cryptojacking deployment procedures as temporary pivot or worker infrastructure.
IPV4	`165[.]154[.]157[.]40`	Cloud VPS referenced in shell history and cryptojacking deployment procedures as temporary pivot or worker infrastructure.
IPV4	`80[.]96[.]109[.]64`	Operator-controlled primary staging host that exposed the operator's home directory through an unauthenticated open directory listing on port 18080.