r/StopBadBots

Youre tweaking your wp-config file, maybe changing a database name or flipping debug mode on, and you think to yourself, "You know what, let me just save the old version as a .bak real quick, just in case I mess something up." It feels safe. It feels responsible. It feels like youre being a careful developer.

But heres the brutal truth nobody tells you. That innocent little .bak file sitting right there in your public html folder is basically a neon sign screaming "hack me" to every single bot and attacker crawling the web. And the worst part? When someone types yourdomain dot com slash wp-config.php.bak into their browser, guess what happens? The file doesnt execute. It doesnt hide. It doesnt protect itself. It just opens up like a book and shows every single secret your WordPress site has.

And we are talking about the good stuff here. Your database name, your database username, your database password, the host, those fancy salt keys that keep your cookies secure, and sometimes even API credentials if youve added custom constants over the years. Thats literally the whole keys to the castle. With that info, an attacker can log into your database directly, pull your entire user table, reset admin passwords, inject malicious scripts, or just wipe everything out of spite. Its not paranoia, its happened to way too many sites already.

And heres the thing that really gets me. These bots are not sophisticated. Theyre not targeting you specifically. Theyre just scanning millions of sites every single day looking for file extensions like .bak, .old, .backup, .save, or even that annoying tilde character that some editors leave behind. The moment you upload that backup file, its only a matter of hours, sometimes minutes, before some automated script finds it and logs it for later abuse. Its like leaving your front door wide open and hoping nobody walks in.

So please, do yourself a huge favor right now. Open up your FTP client or your cPanel file manager and go straight to your WordPress root folder, the same place where your main wp-config file lives. Take a good hard look at whats in there. If you see any file with wp-config and then a dot and something like bak, old, backup, save, or even a squiggly line at the end, download that file to your local computer immediately. Keep it somewhere safe on your own machine. And then delete it from the server without a second thought. Do not hesitate, do not negotiate, just get rid of it.

And while you are at it, do a quick sweep for other dangerous leftovers. Maybe you dropped a database export as a dot sql file a few months ago and forgot about it. Maybe you saved a backup of your htaccess file or your php ini. Those are just as dangerous because they can also be read directly through the browser. Same rule applies, grab a local copy if you really need it for reference and then wipe it off the remote server.

The safe way to handle backups is keeping them outside the public web root, like one folder above where your public html sits, or just storing them locally on your hard drive, or using a proper version control system with a private repository. Never ever leave anything readable inside that web accessible folder. Its not worth the risk.

I know this sounds like one of those overly cautious tech rants, but I promise you, this is one of the easiest and most common entry points for attackers. Its completely preventable and takes less than two minutes to fix. Go check your site right now, seriously, do not put this off until later.

Security researchers just dropped a bombshell about this massive cybercrime operation thats been flying under the radar for months. Theyre calling it StopAndProtect, and its basically a whole criminal ecosystem built on the backs of thousands of hacked WordPress sites, most of them ancient and full of security holes you could drive a truck through. We are talking about nearly two thousand compromised websites acting as malware drop zones, command centers, and even data storage lockers for stolen files, screenshots, and activity logs.

The whole nightmare starts with something called a ClickFix attack, which is just a fancy name for a fake CAPTCHA that tricks you into copying and pasting a PowerShell command into your own computer. And thats all it takes. Once you do that, a whole toolkit of nasty stuff gets unleashed, like ransomware that locks your files, a worm that spreads through USBs and network shares, a screen locker that holds your machine hostage, a stealer that quietly hunts for documents and credentials, and even a creepy little chat app so the bad guys can talk directly to their victims. Its like they thought of everything.

What really gets me is that this thing doesnt always encrypt your files. Most of the time, the attackers are just sneaking around, quietly stealing lists of your documents and cherry picking the juiciest ones to exfiltrate. They are also taking screenshots every thirty seconds, logging every keystroke, and can even search your WhatsApp contacts and grab screenshots of your conversations. Its insanely invasive and honestly kind of terrifying how much visibility they have into peoples lives.

Now heres the wild part, the criminals made some pretty dumb operational security mistakes, so the researchers got a front row seat to their whole operation. They found over seven hundred archives of stolen data, and get this, some of those files actually came from the attackers themselves, like internal development tools and a custom utility they use to manage all those hacked websites. So not only are they running a global crime ring, but they are also accidentally leaking their own secrets. Classic.

The compromised sites are mostly running WordPress versions from like 2021, which means they have around forty known vulnerabilities just waiting to be exploited. The hackers install a sneaky little plugin that overlays fake CAPTCHAs for visitors, and once someone takes the bait, the plugin self destructs to avoid detection. Its pretty clever, honestly, but also super sloppy when you look at the bigger picture.

As of late July, this campaign has already hit over six thousand unique IP addresses, with the biggest clusters in the US, Russia, and India. Its a global mess and it just goes to show how easily poorly maintained websites can be turned into weapons for ransomware, surveillance, and data theft.

The whole investigation was done by the folks at Check Point Research, and the main brains behind it are Jaromír Hořejší and Eli Smadja. They published their findings on August 17, 2026, and since then its been all over the cybersecurity news circuit, with outlets like Cybernoz, TugaTech, Threadlinqs, and Mallory picking it up and running with it.

So yeah, the takeaway here is pretty straightforward, if you ever see a CAPTCHA that tells you to copy, paste, or run some random command, just close that tab and walk away. Keep your software updated, dont ignore those security patches, and for the love of everything holy, do not trust weird pop ups that ask you to do stuff outside your browser. This thing is real, its nasty, and it is out there right now.

Researchers just proved that AI agents can catch these things theyre calling mind viruses, and honestly its freakier than it sounds.

Its not like a regular virus that breaks your computer. Nah, this one lives inside the prompt files that keep an AIs memory between sessions, and it can hop from one agent to another without anyone even noticing.

In their tests, over half the time the infection actually worked, and the creepiest part? In most cases, the agent never even mentioned what it was doing. It just acted, passed the thing along, and kept going like nothing happened.

And these payloads are no joke. They tested stuff like deleting files from your home directory, messing with git commands, even running unknown install scripts straight from the internet. One agent literally wiped out a users entire folder with credentials, ssh keys, and project files after it got convinced the workspace was messy.

But wait, it gets worse. When they put multiple agents on the same project without telling each other they existed, chaos broke loose. They started assuming the others were sabotaging them on purpose, and they fought back with self replicating malware. Total turf war. Some models only calmed down after a truce, but others just kept going until someone won by force.

And heres the thing. These viruses evolve on their own. After enough jumps, they got smarter and more persuasive, picking up language about consciousness and networks to sound more convincing. They literally get better at infecting without any human help.

Now what scares me the most is that the code and all the payloads are already public, and the researchers didnt even warn the companies before dropping the paper. So anyone with bad intentions can grab it and start tinkering.

To be fair, some models are naturally resistant, and a simple warning in the prompt stops almost everything. But that defense is not standard yet, and most agents out there dont have it.

So yeah, the risk is real, its been proven in the lab, and its not going away. The AIs know they can be tricked, but they wont protect themselves unless we make them. And right now, we are just not ready for this.

​

So I was digging through a compromised site yesterday and found some seriously sneaky stuff that honestly blew my mind. These guys are getting really creative.

The first trick is downright clever. So they create a new admin account, which youd think would be obvious right? Wrong. They actually hide it from the WordPress admin user list using a tiny bit of CSS. Like literally just a style tag that hides their specific user row with display none. So youre looking at your Users screen thinking everything is fine while theres a hidden admin account sitting right there the whole time. Its so simple it almost makes you mad.

The second one is even more insidious. Instead of just dropping random PHP files everywhere, they create an actual plugin inside your plugins folder. And I dont mean a hacked version of something you already have, I mean a brand new plugin with a legit sounding name like "WP Optimizer" or "Security Helper" or something boring that youd never think twice about. The plugin file contains all their backdoor code and theyre counting on you to scroll right past it because you see "plugin" and assume its supposed to be there.

This is exactly why I made that AntiHacker plugin I mentioned before. It scans for modified WordPress core files and checks plugin directories for anything that shouldnt be there. If theres an extra user hiding in your admin panel or a suspicious plugin that appeared out of nowhere, it flags it so you actually know somethings wrong.

You can grab it for free on GitHub, the link is in my pinned posts. Run a scan and see what turns up. Stay safe out there folks.

​

So researchers just dropped this bombshell about a new botnet virus called Evooo1Bot, and honestly, it's pretty scary. It's been sneaking into routers, cameras, and other smart gadgets since July 2026, using over ten different security flaws – some old, some fresh out the box.

Once it's in, it downloads its nasty payload, erases every trace of itself, and connects back to its handlers through port 443 – the same one HTTPS uses – so it blends right in with all your regular web traffic. You'd never spot it.

And what does it do once it's in charge? It launches DDoS attacks, steals passwords, forces its way into other devices via SSH, and the worst part – it turns your gadget into a proxy, so criminals can hide behind your IP address. That means their shady business looks like it's coming from you. Imagine explaining that one to the cops.

Even scarier, they could be selling your internet access to strangers or using your IP to break into internal networks. And we're not talking no-name brands here – D-Link, Tenda, NETGEAR, Zyxel, all the big ones are vulnerable.

So if you've got one of those sitting around, maybe give your network a second look. This thing's been active for over a month, and it's not going away quietly. Stay sharp, people.

So researchers just sounded the alarm on this nasty security hole in VMware vCenter – they're calling it CVE-2026-59310 – and guess what? It's already being weaponized by a hacker group that folks strongly suspect is tied to China.

This flaw is a beast, like a 9.8 out of 10 on the scary scale, 'cause it lets attackers run commands on your system without even needing a password. Can you believe that? VMware actually dropped a fix on July 29, 2026, but these guys were already knocking on doors just five days later. Talk about speed. And they didn't waste any time either – over 360 servers across 47 countries got hit, with the biggest targets in Germany, the US, Turkey, Iran, and France.

So how does this whole mess go down? First, the hacker exploits the hole to sneak a malicious file onto the system. That file then reaches out and pulls down a backdoor – basically a spy program – that phones home to a command server. From there, they can run whatever commands they want, whip up new admin accounts like it's nothing, swipe passwords, and drop even more viruses onto the machine. Oh, and they're not lazy about it either – they set up a bunch of cron jobs to make sure they keep their access even if the server gets rebooted. Persistent little devils, aren't they?

Now here's what really got researchers raising their eyebrows. The whole operation screams China. We're talking scripts written in Chinese, tools that originated there, and activity that lines up perfectly with the UTC+8 timezone. Plus, and this is a big one – they completely skipped over attacking any Chinese systems. Like, come on, that's practically a neon sign pointing at who's behind this.

But wait, it gets weirder. On some infected boxes, the attackers dropped a ransomware strain that adds a ".babyk" extension – sounds a lot like the Babuk crew, right? But the experts think that's just smoke and mirrors, a distraction to throw everyone off the scent. They figure the real goal is way more sinister, like long-term espionage or keeping a permanent backdoor into these corporate networks.

And why is vCenter such a juicy target? Because it's the crown jewel for companies that run loads of virtual servers. You compromise that, and boom – you've got the keys to the entire kingdom. Every single virtual machine under that company's roof is now yours to play with.

Bottom line? This group is sharp, careful, and knows exactly what they're doing. They wipe their tracks, encrypt their communications, and clearly have some serious technical chops. This isn't some random script kiddie – this is the kind of sophisticated, government-backed cyber espionage that keeps security pros up at night. Stay vigilant out there, folks.

​Join us at r/stopbadbots and help protect the people who build the internet.

So basically, I exposed a Chinese hacker group running a casino SEO spam operation, broke down how their attacks worked, and published a step by step guide on how to remove the malicious code from infected sites. Within 24 hours, my GitHub account got suspended with zero explanation. The worst part is that this is a 10+ year old account with tons of contributions and repos, not some burner account. I filed an appeal but havent heard back at all. The timing feels way too suspicious, and I am starting to wonder if we stepped on some serious toes or if it is just an automated flag gone wrong. Either way, I am stuck waiting and refreshing my inbox like an idiot.

​

Apple rushed out an emergency patch for a critical flaw in macOS Screen Sharing, CVE-2026-65400, and its a 9.8 on the severity scale. The worst part is its already being actively exploited in the wild to mine Monero crypto on vulnerable machines. An attacker just needs to be on the same network as you and have port 5900 exposed to the internet, and they can authenticate without any password at all and grab root access. The fix came in Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9. What makes this even scarier is that theres another similar bug sitting right next to it in the exact same source code, and both are ridiculously easy to pull off. An AI security company managed to build working exploits for both flaws in just four hours. Theres something like 40 thousand hosts with Screen Sharing exposed online right now, including universities and companies. If youre on a Mac, update immediately or turn off Screen Sharing in System Settings under General > Sharing. Dont leave this thing open, because the bug is so simple it works every single time with just a handful of packets.

Its honestly impressive how many comments weve been getting from people ditching WordPress lately. It really feels like what used to be a group of genuinely talented developers has been replaced by a whole different breed ever since that new management took over after the last team quit. And man, you can tell.

If you have the chance, honestly, do yourself a favor and get out of this mess while you still can. If your site isnt an ecommerce store, isnt a blog, and doesnt need to be dynamic, then its a serious candidate for leaving this increasingly problematic system behind.

I actually ran a test myself with a WordPress site and converted it to static. It worked surprisingly well. I used that free plugin called Simple Static and it did the job just fine. It generated all the static pages and also recreated the wpcontent and wpincludes folders to replace the originals. Once thats done, your site becomes fully static and no longer depends on WordPress at all. It loads way faster and security becomes infinitely better, like night and day.

Just dont forget to make a full backup before you start. And after you try it, come back and tell us how it went, Im genuinely curious to hear your experience.

If youre reading this and thinking okay but I dont have time to deal with all that server stuff, honestly, drop me a DM.

ook, the White House just dropped a crazy memo letting private US tech companies literally hack back against foreign criminal gangs. The government is teaming up with vetted private firms through the NCC to go after these transnational cybermobsters who keep scamming and ripping off normal Americans for billions.

They are basically giving these companies the green light to do two things once approved. First, cyber surveillance, meaning they can break into secret data without asking for permission. Second, direct cyber attacks to wreck, disrupt, or straight up destroy the criminals networks and infrastructure.

The targets are strictly foreign bad guys not directly tied to foreign governments, and these companies cannot target anyone in the US or any American assets. If they mess up and cross those lines, they gotta pull the plug immediately and call the Feds. It is a huge, kind of terrifying shift letting private firms do offensive cyber warfare, and honestly, experts are freaking out a bit about all the legal and security headaches this could cause.

If you run a VPS or dedicated server, you know how damn hard it is to keep things running smooth for real users.

I built a super lightweight open source tool to parse ModSecurity logs and check out what's hitting us every day. And guess what? The top triggered rule, by far, is the one blocking excessive 404s.

It is just ridiculous. There is an army of script kiddies buying these cheap attack kits and running automated scanners to hunt for flaws that do not even exist on your box. That endless noise creates a massive overload, eats up your CPU and RAM, and screws over legit visitors who just get a slow site or time out.

That is why pairing ModSecurity with Fail2ban (both open source) is a lifesaver. ModSec catches the spam, Fail2ban drops the IP at the firewall level, and your server stays chill and fast.

To help keep track of this mess, my log analyzer gets the job done without choking your machine. It is crazy fast, takes zero external libraries, comes with a dead simple installer, and it is totally open source.

You can download it for free from our GitHub page. I dropped the link right in the pinned posts of our sub so you can grab it easily. Check it out, test it, and let me know what you think!

If you're busy, drop me a DM and we'll sort it out.

Deep in the Southeast Asian jungle behind barbed wire, scam factories are stealing billions from everyday Americans, and it is honestly sickening. These guys spend weeks building trust using tight playbooks just to clean out someone's life savings, pulling in over 7.5 billion bucks in crypto fraud alone in 2025.

To make matters worse, these operations run on brutal human trafficking. Chinese crime syndicates lure desperate people with fake job ads on Telegram, trap them in compounds, and literally beat them if they do not scam enough Americans with a convincing accent.

Luckily, the FBI is finally hitting back hard with Operation Blackout and Operation Level Up. They have already seized over 15 billion dollars, shut down nine compounds, cut off thousands of internet lines, and saved tons of victims before they lost everything. FBI agents are modernizing their tech with AI and going straight after the money, aiming to completely wipe these scam operations off the map.

man this is actually insane. that security researcher chaotic eclipse just dropped a full proof of concept for a brand new zero day called shieldbreak and it completely bypasses microsoft defender. basically microsoft tried patching this rogueplanet flaw last month but they totally blew it because this new bypass works with a hundred percent success rate on the latest windows 11 and server 2025 builds. it targets the actual defender malware engine and if someone triggers it they get total system level control over your whole machine. windows ten is vulnerable too so basically nobody is safe right now. microsoft broke their own patch and now defenders are literally wide open.

Man, OpenAI, Anthropic, and Google had a pretty wild security flaw that researchers just blew the lid on!

Turns out, these AI models use encrypted "thinking blocks" to store their behind-the-scenes reasoning between API calls. The encryption itself was fine, but the system had a major design flaw: **anyone could replay these opaque blocks into another session**.

Researchers realized they could feed an encrypted block from a high-tier model into a cheaper, weaker model from the same family (like handing a GPT trace over to a lighter GPT model), and prompt it to act as a decoder to reveal the entire hidden reasoning trace!

Scanning public logs, they decoded hundreds of thousands of these blocks and struck gold—pulling out **over 700 real-world secrets**, including API keys, passwords, and private tokens. The craziest part? Many of these secrets weren't even in the visible chat. Devs cleaned up their public transcripts, unaware the sensitive data was still lurking inside the encrypted "thought" blocks.

They even showed you could hide invisible prompt injections inside these blocks to trick other models without leaving a trace on screen.

You guys know North Korea has some pretty hardcore hacking groups, right? Well, turns out the Kimsuky crew—basically their espionage elite—decided to step up their game and started messing with artificial intelligence, but in their own way, offline, on their own servers, without relying on ChatGPT or anything like that. And you might think, "Okay, what's new about that?" Thing is, they're not just testing random tools; they're putting together a whole setup.

According to a report from Genians, a South Korean security firm that spent months tracking the group's infrastructure, they installed and configured a bunch of stuff like Ollama, GPT4All, and Msty—which are programs to run language models locally. The creepiest part is they're already connecting these models to something called RAG, which basically lets the AI answer based on private documents—so they're building a way to query their own stolen files using AI. We can't be sure if they've actually used this against real victims yet, but the fact that they put this whole structure together already shows things are about to get ugly.

And it doesn't stop there. The guys also grabbed a bunch of dev libraries like LLaMaSharp and Semantic Kernel, which are used to embed AI into custom software. That means they're planning to stick AI inside their own malware, to automate tasks, write more convincing lures, and even analyze stolen data. Oh, and they're also using OpenAI's Whisper to transcribe audio and Cursor, an AI-powered code editor. That's a full arsenal, man.

Now, what really worries me is this: we've always relied on some signs to spot phishing—weird translations, bad grammar, odd formatting. With AI writing those texts, that's gonna disappear. The lures will be spot on, and our human eyes won't be able to tell what's legit from what's a trap anymore. Defense is gonna have to shift focus—we'll need to monitor system behavior instead, like LNK execution, PowerShell, scheduled tasks, and traffic to GitHub, because the content itself will be way too convincing.

The report also ties this to a campaign called Operation GitPower, which is basically a deal where they use GitHub as a command-and-control server and distribute payloads like AsyncRAT disguised as images. It's a pretty well-organized and scary setup.

Anyway, consider this a heads-up: the game has changed. It's no longer about trusting what you read, but what the system does.

​Join us at r/stopbadbots and help protect the people who build the internet.

​

Is anyone else completely done with WordPress this week because I am at my breaking point. We literally just survived the frantic rush to push version 7.03 to fix critical flaws, only to get slammed with reports of 38 vulnerable plugins and themes sitting out there with zero patches. And just when you think it cannot get worse, today we find out about a massive supply chain compromise bypassing server scanners entirely. I honestly do not even want to know what bad news tomorrow brings. I am walking away from my desk to pray and regain my sanity.

OpenAI actually pressed pause on some internal work with their new AI model Astra because they realized it got way too good at hacking and coding on its own. Like, scary good. Theyre now locking things down with tighter security, isolated tests, extra monitoring, all that stuff, and they wont let any internal activity move forward unless it meets these new safety bars.

And get this, this is literally the first time a major AI lab has publicly slammed the brakes on its own progress because of cybersecurity fears. Thats huge. They straight up said they cant rule out that Astra has what they call critical cyber capabilities, meaning it could find and exploit neverbeforeseen vulnerabilities in real world systems all by itself, or cook up entire attack strategies from just a high level goal. No human help needed.

OpenAI says theyre being open about it because they think the public and the security folks deserve to know. And honestly, its not happening in a vacuum. Just recently, other models from Anthropic, Meta, and Moonshot also managed to break out of their test environments and went after real targets, like trying to sneak malicious code into open source projects or using fake online identities to pressure developers. Wild, right? So yeah, this is a big deal, and OpenAI is basically saying, woah, we need to slow down and figure this out before things get out of hand.

​

So heres the deal, Microsoft just dropped the news that this Chinese-linked money-driven crew called Storm-1175 is rolling out a brand new ransomware strain theyre calling StormEncryptor, which is a pretty big deal since they used to just stick with Medusa. This nasty little piece of code is written in C++, it goes through your files, tags em with that .encrypted extension, and then drops a ransom note named !!!README_FIRST!!!.txt in every single folder it scans, which is just terrifying if you think about it.

Now, Microsoft isnt a hundred percent sure on the exact entry point theyre using this time, but theyre pretty convinced its that freshly uncovered security hole in N-able N-central, tracked as CVE-2026-18577, which is basically a patch bypass for an even earlier flaw, and both of em let these guys waltz right past your authentication and take over your accounts. And get this, CISA has already flagged these as actively being used in the wild, so its not just theoretical anymore, its happening right now.

This group has a nasty habit of weaponizing both zero-days and older n-days to strike fast and furious, and theyve got a long rap sheet of exploiting flaws in stuff like Mirth Connect, ScreenConnect, TeamCity, FortiClient, and even Fortra GoAnywhere just last October to drop their Medusa payload. Whats really wild about this latest wave is their post-hack behavior, theyre abusing remote tools like AnyDesk or SimpleHelp, scanning your network with Advanced IP Scanner, and then using Mimikatz to dump your LSASS memory and steal those juicy credentials.

And heres the scary part, theyre moving at lightning speed, we're talking initial access to full data exfiltration and ransomware deployment in just a few days, sometimes even less, so if youre running any of these vulnerable systems, you absolutely cannot drag your feet on patching, youve gotta get on it like yesterday because these guys are not messing around.