After TeamUpdraft’s website breach, Patchstack says attackers began using stolen UpdraftCentral keys on October 18 to backdoor connected WordPress sites, finding at least 99 malicious plugins. BleepingComputer reports that the keys could potentially expose roughly 400,000 sites.
These keys are delegated control credentials: they let attackers send commands through the remote-management channel site owners had authorized. Patchstack says attackers used that access to run code, create administrator accounts and install backdoor plugins disguised as maintenance tools.
TeamUpdraft says it replaced potentially affected keys and credentials, but that does not establish that sites already reached were cleaned. If an agency manages many WordPress installs through UpdraftCentral, the vendor-side breach can leave rogue accounts and backdoors on individual sites even after the shared keys stop working.
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.