FBI Warns of Fake Govt Sites, ISIS Defacements
Summary: The FBI warned that individuals sympathetic to ISIS are mass-defacing WordPress sites using known plug-in vulnerabilities for which security updates already exist, targeting news organizations, commercial entities, religious institutions, and government sites. A separate FBI alert described criminals hosting fraudulent government services sites that rank high in search results, collect PII through fake forms, charge fees of $29 to $199, and then instruct victims to mail in birth certificates or other identification.
What you should know: The FBI's own assessment is that the perpetrators are not actually associated with ISIL and are using the group's name for notoriety, so the real exposure is unpatched WordPress plug-ins rather than a terrorist campaign. On the fraud side, victims hand over PII and physical identity documents for a fee before realizing the site was never a government agency.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026