Cyber Trickery: WooCommerce Users Lured by Fake Patch Scheme

At a glance

• Threat Alert: A large phishing campaign targets WooCommerce store owners.
• Fraudulent Scheme: Fake security alerts trick admins into installing a malicious “patch” plugin.
• Implications: Installing it hands attackers a hidden admin account and a backdoor into the store.
• Key Players: The criminals behind the campaign remain unidentified.

A fake WooCommerce security alert

Attackers are going after WooCommerce, the e-commerce plugin used by millions of WordPress stores, with fake security warnings. The emails, reported by Patchstack in April 2025, claim the store is affected by an “Unauthenticated Administrative Access” vulnerability and urge the owner to install a patch right away. Store owners who care about security are exactly who the scam targets.

The emails look convincing. They copy WooCommerce branding and point to lookalike domains, so many recipients believe the message really came from the WooCommerce team. The goal is to get the attacker’s own code running on the store.

How the fake patch scheme works

The steps of the scam

The link leads to a fake WooCommerce site where the victim downloads a plugin, a ZIP file named “authbypass-update-31297-id.zip.” Once installed, it creates a hidden administrator account with a random name, sends the details to a server at woocommerce-services[.]com, and pulls down web shells that give the attackers lasting control.

The level of detail is what makes the scheme work. The fake site and the alert copy WooCommerce’s look closely enough to fool busy store owners.

Spotting the warning signs

The campaign depends on looking like real WooCommerce mail. Check the sender address carefully and watch for odd domains or small errors. Real plugin updates arrive through the WordPress dashboard, not as ZIP files linked from an email. If you installed the plugin, look for unfamiliar admin users with random 8-character names, unexpected cron jobs and outbound requests to the domains above.

The cost for small store owners

A hijacked store can be turned against its customers. With admin access, attackers can steal data, plant card skimmers or redirect payments. Small and medium-sized businesses that run on WooCommerce often lack the security staff to notice quickly, and the financial and reputational damage can be severe.

Smaller shops are hit hardest because they rarely have dedicated security staff or monitoring. One compromised admin account can be enough to wreck a small business’s reputation.

Who is behind it

The people running the campaign have not been identified. As online stores grow, so do the scams that target them.

Security researchers advise WooCommerce users to turn on multi-factor authentication, change passwords regularly and treat unsolicited “security patch” emails with suspicion. Install updates only from the WordPress dashboard or WooCommerce’s own site.

Protecting your store

Phishing keeps getting more convincing, and careful habits are the first line of defense. This campaign shows how attackers turn store owners’ concern for security into a way in.

Every business that sells online, large or small, should know how its updates arrive and who is allowed to install them. A few minutes of checking can stop a scam like this one.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.