Hackers Abuse Google Ads to Steal Users GoDaddy ManageWP login Credentials

Cybersecuritynews •Tushar Subhra Dutta • May 7, 2026

Hackers are using fake Google ads to steal login credentials from ManageWP users, GoDaddy’s popular platform for managing WordPress websites from a single dashboard. The campaign, which researchers have dubbed “WrongPress,” plants a fraudulent result directly above the real ManageWP listing, trapping users before they even realize something is wrong. ManageWP is widely […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Ads Phishing Campaign Targets GoDaddy ManageWP Users A phishing campaign exploiting Google Ads is targeting users of GoDaddy's ManageWP platform, which is used for managing multiple WordPress sites. The attackers employ an adversary-in-the-middle (AiTM) technique, creating a fake login page that captures user credentials in real-time. This fraudulent ad appears above the legitimate ManageWP listing in search results, tricking users into entering their credentials. Once logged in, victims are prompted for their two-factor authentication (2FA) codes, which the attackers also capture. Guardio Labs has identified 200 unique victims so far and has infiltrated the attackers' command-and-control infrastructure. The phishing framework appears to be privately developed, with indications of a Russian-language agreement found in the code. The campaign is significant due to the number of potential victims, as ManageWP is active on over 1 million websites. 3 sources 67

Extracted Entities

Hackers Abuse Google Ads to Steal Users GoDaddy ManageWP login Credentials

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (3)