Hackers Exploit Google Ads to Steal GoDaddy ManageWP Logins

Gbhackers •Mayura Kathir • May 7, 2026

Hackers are abusing Google Ads to steal GoDaddy ManageWP credentials by placing a look‑alike phishing ad above the legitimate ManageWP result and proxying victims’ logins in real time via an adversary‑in‑the‑middle (AiTM) setup. The attackers purchase a Google ads that imitates ManageWP branding and appears as the top result, while the legitimate domain is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Ads Phishing Campaign Targets GoDaddy ManageWP Users A phishing campaign exploiting Google Ads is targeting users of GoDaddy's ManageWP platform, which is used for managing multiple WordPress sites. The attackers employ an adversary-in-the-middle (AiTM) technique, creating a fake login page that captures user credentials in real-time. This fraudulent ad appears above the legitimate ManageWP listing in search results, tricking users into entering their credentials. Once logged in, victims are prompted for their two-factor authentication (2FA) codes, which the attackers also capture. Guardio Labs has identified 200 unique victims so far and has infiltrated the attackers' command-and-control infrastructure. The phishing framework appears to be privately developed, with indications of a Russian-language agreement found in the code. The campaign is significant due to the number of potential victims, as ManageWP is active on over 1 million websites. 3 sources 67

Extracted Entities

Hackers Exploit Google Ads to Steal GoDaddy ManageWP Logins

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)