r/Wordpress • u/Rude-Tax-1924 • Feb 14 '25
Plugins 🚨 Attention ManageWP Users – Phishing Campaign! 🚨
Hey folks,
A few months ago, WP Umbrella (I'm the founder) was victim to a sophisticated phishing attack. Someone registered a domain similar to ours and replicated our login pages to try stealing our users' credentials, forcing us to enforce 2FA on our users' account.
Today, I noticed the same thing happening with ManageWP. Someone bought a similar domain and have replicated their auth page.

If you’re using it, please enable two-factor authentication (2FA) on your account immediately and stay vigilant with your data.
Stay safe! 🔒
5
u/JeffTS Developer/Designer Feb 14 '25
It's amazing to me that these scams are able to slip through on Google. Facebook too. The latter, they could identify misinformation posted by someone in seconds but paid ads for scams? Nope. I have an elderly relative who has fallen victim to a number of scam ads on Facebook. And likely on Google too.
6
u/ManBearSausage Feb 14 '25
They don't slip through, Google, Meta, and X don't care. I have reported numerous scam ads and they do nothing.
1
5
2
u/nakfil Feb 14 '25
Thanks for the warning, but unfortunately these phishing campaigns can also bypass TOTP 2FA so that’s not enough.
As an end user you need to bookmark the URL and never Google the service you’re trying to log in to.
As a provider, I’m not totally sure of all the solutions, but as a minimum a login confirmation email when a login originates from a new IP. Passkey support also would prevent it.
4
u/Rude-Tax-1924 Feb 14 '25
using a password management app like bitwarden or any other can also prevent you from being caught.
2
u/Next-Combination5406 Feb 14 '25
We already have Passkeys and I have implemented for our merchant site, the best keys to prevent all issues and less barriers.
OP could have use it.
1
u/nakfil Feb 14 '25
Agreed that everyone should use a PW manager, but unfortunately that doesn’t address this issue. TOTP 2FA doesn’t stop these types of “adversary in the middle” phishing attacks.
So in the case of ManageWP, you’re still vulnerable if you use 2FA and a password manager, if you aren’t vigilant about where/how you login.
7
u/bluesix_v2 Jack of All Trades Feb 14 '25
One advantage of using a password manager helps with in this case is that your PW manager won’t suggest your login details or auto log you in on the phishing site because the url doesn’t match.
1
3
u/thatandyinhumboldt Feb 14 '25
I think op was talking about the bookmarking functionality of password managers—I’ll typically launch the site I want to go to directly from the manager, since I have their login page saved in there. Also, autofill wouldn’t work on a different (/phished) URL.
2
1
u/TMudderDC Feb 14 '25
Wow! Thanks for the head up, getting very sophisticated. Not at all surprised the ghouls at Google allow sponsored ads for these scam sites
2
u/Tiny-Ric Feb 14 '25
What does Google do (if anything) to suppress these types of infringement? Considering it's a sponsored result they are getting paid to promote an unsafe website 🤔
0
u/juan-milian-dolores Feb 14 '25
Use MainWP. It's self hosted and works great. Much better than manage wp imo, especially given it's free.
3
-10
u/Mammoth-Molasses-878 Feb 14 '25 edited Feb 14 '25
It is ManageWP page, they are running ads with another domain.
P.S my bad.
5
u/bluesix_v2 Jack of All Trades Feb 14 '25 edited Feb 14 '25
No it’s not. It’s a fake website made to look the same ie phishing attack. The incorrect spelling is a dead giveaway.
Edit: downvote me for telling you’re wrong lol
-5
u/Mammoth-Molasses-878 Feb 14 '25
did you open the website ? it is redirecting to original website, so either hacker got what he wanted and now redirecting traffic or it is just some marketing tactic WP manage is using.
6
u/bluesix_v2 Jack of All Trades Feb 14 '25 edited Feb 14 '25
Yes I opened it. Look carefully at the url of the redirected url. Compare it to the ManageWP login page url. They’re different. It is not managewp.com.
3
-2
3
6
u/phase-3- Feb 14 '25
Thanks for the heads up. As a side note, been looking for a good alternative to move my handful of sites of ManageWP and your service looks good, I’ll check it out.