TIKTOUK targets exposed WordPress backups to steal cloud and email credentials, with 50,000 credentials found across 37,000 domains.
Brevo supply-chain attack injected malicious JavaScript into 100,000+ sites, targeting WordPress admins and visitors with ClickFix prompts.