A cybercrime toolkit called TIKTOUK has been designed to find exposed WordPress files and recover credentials stored on vulnerable sites. Researchers found a leaked control panel holding around 50,000 server-side credentials linked to roughly 37,000 domains, including hundreds of AWS keys reported as active. The findings underline why secure backups and routine WordPress maintenance matter.
Key takeaways
- TIKTOUK searches for exposed backups, configuration files and secrets in website code.
- Its components can recover email passwords and collect cloud credentials from accessible data.
- Researchers demonstrated the toolkit’s behaviour in controlled tests, but did not confirm a live-site breach from those tests.
- Protecting backups, updating WordPress and reviewing credentials can reduce risk.
What the toolkit looks for
TIKTOUK combines two Python programs with a Linux-based crawler. The components request tasks from a central service, then report findings. They probe WordPress sites and seek files such as configuration backups, environment settings, database backups, repository files and debug logs—materials that may accidentally be accessible through a public website.
If the collector finds a WordPress configuration backup, it can extract database details and security keys. It also supports recovery of passwords stored by several popular SMTP plugins. This does not mean the toolkit has cracked strong encryption: researchers found it could use information from WordPress configuration files to decrypt protected settings.
A separate crawler scans webpages and linked JavaScript for patterns that resemble API keys or cloud credentials. The leaked panel contained credentials associated with services including AWS, email delivery and AI tools, creating potential risks beyond the compromised website.
What researchers confirmed—and what they didn’t
LevelBlue researchers examined the toolkit and tested its components under controlled conditions. They linked its request patterns to two vulnerability identifiers, but did not demonstrate successful exploitation. The tests used prepared responses rather than executing SQL against a live WordPress installation, and they do not independently prove that credentials were stolen from real sites.
That distinction matters: the research shows how the toolkit is built to operate, not that every site it targeted was breached. Unusual WordPress batch requests, attempts to access sensitive files and later submissions of results may help security teams investigate, but a single request or file path is not proof of compromise.
How to reduce the risk
Treat backups and configuration files as sensitive data. Store backups outside the public web directory where possible, remove old copies from public locations, and check that files such as wp-config.php.bak, .env and backup.sql cannot be fetched anonymously. If exposure is suspected, rotate database, email and cloud credentials, then review account activity for unauthorised use.
A WordPress maintenance plan or care plan can help make these checks part of regular site upkeep, alongside timely core and plugin updates and reliable backups. After any suspected exposure, review server logs for unusual requests and verify alerts against your own records before concluding that a breach occurred.
Sources
- Exposed WordPress Backups Became a Gold Mine of AWS and Email Credentials, CyberSecurityNews.