Hackers abuse Google ads for GoDaddy ManageWP login phishing
2026-05-07T07:23:27Z•ae3ccf9b5690d7449bb8cb7e7e101281cb47ccd4de0c5b369b1e093285b7a8c1
backdoorchaos-ransomwareciscocredential-theftdaemon-toolsdata-breachdenial-of-servicegodaddygoogle-adsinstructure-breach','vimeo-breach','kochava','location-data','ftlinux-malwaremanagewpmanual-rebootmuddywaternodejspalo-altopan-osphishingquasar-linuxremote-code-executionrootkitsandbox-escapesupply-chainvm2zero-day
What happened
Multiple high-impact security stories: an actively exploited Palo Alto PAN-OS User-ID Authentication Portal zero-day; a critical vm2 Node.js sandbox escape allowing arbitrary host code execution; a Cisco Crosswork/NSO denial-of-service that requires manual reboots; and a DAEMON Tools supply-chain compromise that delivered a backdoor via trojanized installers. Other notable items include a Google Ads-based phishing campaign targeting GoDaddy ManageWP credentials, MuddyWater using Chaos ransomware as a decoy, a new Quasar Linux implant targeting developers (rootkit/backdoor/credential theft), a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- ae3ccf9b5690d7449bb8cb7e7e101281cb47ccd4de0c5b369b1e093285b7a8c1
- Enrichment time
- 2026-05-07T07:23:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.