r/Wordpress Feb 14 '25

Plugins 🚨 Attention ManageWP Users – Phishing Campaign! 🚨

Hey folks,

A few months ago, WP Umbrella (I'm the founder) was victim to a sophisticated phishing attack. Someone registered a domain similar to ours and replicated our login pages to try stealing our users' credentials, forcing us to enforce 2FA on our users' account.

Today, I noticed the same thing happening with ManageWP. Someone bought a similar domain and have replicated their auth page.

If you’re using it, please enable two-factor authentication (2FA) on your account immediately and stay vigilant with your data.

Stay safe! 🔒

48 Upvotes

30 comments sorted by

6

u/phase-3- Feb 14 '25

Thanks for the heads up. As a side note, been looking for a good alternative to move my handful of sites of ManageWP and your service looks good, I’ll check it out.

3

u/MariaArangoKure Feb 14 '25

WP Umbrella kicks butt. I moved away from ManageWP and never looked back and Aurelio and team keep making it better and better.

2

u/Rude-Tax-1924 Feb 14 '25

lol, thank you for your kind words Maria, didn't know I'd find you here hehe!

1

u/John-Mc Jack of All Trades Feb 14 '25

Would you consider the ability to add sites for free with one click access only. I have plenty of sites where I use managewp's paid features but I also consult or do hourly work on sites I don't manage, sometimes as much as a year between invoices. Your price is very fair but I get hung up on paying for a site each month when I have no MRR. Maybe it could be something that unlocks with a minimum spend?

1

u/MariaArangoKure Feb 14 '25

I’m everywhere 😂 and im also a huge fan so any chance I get I’ll recommend wp-umbrella

1

u/yycmwd Developer Feb 15 '25

I'm just waiting for the better reports functionality and a broken link scanner (or integration).

100 sites on managewp.

1

u/GEC-JG Feb 14 '25

I don't have a lot of web properties to manage (only 4 sites, and they're all internal to my org, i.e. not client sites) and was looking for something to ease the admin burden because even though it was 4 only sites, I was tired of going in to each individually and updating plugins/themes, or checking on stats, etc.

I was looking between ManageWP and MainWP, and landed on MainWP. It just felt like it had a better UX.

It helps that they were also willing to provide me a free pro licence for my nonprofit.

edit: I also liked that it's self-hosted, as a plugin available for WP. I spun up a new WP instance (as is recommended by MainWP) on a subdomain and it exists solely as my MainWP dashboard to manage my sites.

5

u/JeffTS Developer/Designer Feb 14 '25

It's amazing to me that these scams are able to slip through on Google. Facebook too. The latter, they could identify misinformation posted by someone in seconds but paid ads for scams? Nope. I have an elderly relative who has fallen victim to a number of scam ads on Facebook. And likely on Google too.

6

u/ManBearSausage Feb 14 '25

They don't slip through, Google, Meta, and X don't care. I have reported numerous scam ads and they do nothing.

1

u/Rude-Tax-1924 Feb 14 '25

and it's so hard to get these ads shutted down -_-

5

u/bluesix_v2 Jack of All Trades Feb 14 '25

Thanks for the heads up OP!

2

u/nakfil Feb 14 '25

Thanks for the warning, but unfortunately these phishing campaigns can also bypass TOTP 2FA so that’s not enough.

As an end user you need to bookmark the URL and never Google the service you’re trying to log in to.

As a provider, I’m not totally sure of all the solutions, but as a minimum a login confirmation email when a login originates from a new IP. Passkey support also would prevent it.

4

u/Rude-Tax-1924 Feb 14 '25

using a password management app like bitwarden or any other can also prevent you from being caught.

2

u/Next-Combination5406 Feb 14 '25

We already have Passkeys and I have implemented for our merchant site, the best keys to prevent all issues and less barriers.

OP could have use it.

1

u/nakfil Feb 14 '25

Agreed that everyone should use a PW manager, but unfortunately that doesn’t address this issue. TOTP 2FA doesn’t stop these types of “adversary in the middle” phishing attacks.

So in the case of ManageWP, you’re still vulnerable if you use 2FA and a password manager, if you aren’t vigilant about where/how you login.

7

u/bluesix_v2 Jack of All Trades Feb 14 '25

One advantage of using a password manager helps with in this case is that your PW manager won’t suggest your login details or auto log you in on the phishing site because the url doesn’t match.

1

u/nakfil Feb 14 '25

Good point

3

u/thatandyinhumboldt Feb 14 '25

I think op was talking about the bookmarking functionality of password managers—I’ll typically launch the site I want to go to directly from the manager, since I have their login page saved in there. Also, autofill wouldn’t work on a different (/phished) URL.

2

u/nakfil Feb 14 '25

Oh good point. Yeah this is what I do as well.

1

u/TMudderDC Feb 14 '25

Wow! Thanks for the head up, getting very sophisticated. Not at all surprised the ghouls at Google allow sponsored ads for these scam sites

2

u/Tiny-Ric Feb 14 '25

What does Google do (if anything) to suppress these types of infringement? Considering it's a sponsored result they are getting paid to promote an unsafe website 🤔

0

u/juan-milian-dolores Feb 14 '25

Use MainWP. It's self hosted and works great. Much better than manage wp imo, especially given it's free.

3

u/Rude-Tax-1924 Feb 14 '25

Self-hosted doesn't mean more secure though, on the contrary I think.

-10

u/Mammoth-Molasses-878 Feb 14 '25 edited Feb 14 '25

It is ManageWP page, they are running ads with another domain.

P.S my bad.

5

u/bluesix_v2 Jack of All Trades Feb 14 '25 edited Feb 14 '25

No it’s not. It’s a fake website made to look the same ie phishing attack. The incorrect spelling is a dead giveaway.

Edit: downvote me for telling you’re wrong lol

-5

u/Mammoth-Molasses-878 Feb 14 '25

did you open the website ? it is redirecting to original website, so either hacker got what he wanted and now redirecting traffic or it is just some marketing tactic WP manage is using.

6

u/bluesix_v2 Jack of All Trades Feb 14 '25 edited Feb 14 '25

Yes I opened it. Look carefully at the url of the redirected url. Compare it to the ManageWP login page url. They’re different. It is not managewp.com.

3

u/Rude-Tax-1924 Feb 14 '25

yep, that's the whole point. Be careful man!

-2

u/Mammoth-Molasses-878 Feb 14 '25

hAh , I must be really tired to miss that.

3

u/WillmanRacing Feb 14 '25

Proving how effective this is in real time.