Alert: WordPress Security Team Impersonation Scams
The WordPress Security Team is aware of multiple ongoing phishing scams impersonating both the “WordPress team” and the “WordPress Security Team“ in an attempt to convince administrators to install a plugin on their website which contains malware. The WordPress Security Team will never email you requesting that you install a plugin or theme on your site, and will never ask for an administrator username and password. If you receive an unsolicited email claiming to be from WordPress with instructions similar to those described above, please disregard the emails and indicate that the email is a scam to your email provider. These emails link to a phishing site that appears to be the WordPress plugin repository on a domain that is not owned by WordPress or an associated entity. Both Patchstack and Wordfence have written articles that go in to further detail. Official emails from the WordPress project will always: Come from a @wordpress.org or @wordpress.net domain. Should also say “Signed by: wordpress.org” in the email details section. The WordPress Security Team will only communicate with WordPress users in the following locations: the Making WordPress Secure blog at make.wordpress.org/security the main WordPress News site at wordpress.org/news The WordPress Plugin team will…
…Full post on Dot Org News
Read Full
