BreakglassIntelligence
Back to reports
highMalware

NetScan/WPMagic CaaS: Mass WordPress Exploitation Panel Unmasked (wpmagic.net + xssnew.com)

Originally shared via @BreakGlassIntel thread on 2026-04-17.

InvestigatedApril 17, 2026PublishedApril 17, 2026
netscanwpmagiccaasxssnewunmasked

Classification: TLP:AMBER
Investigation ID: GHOST-2026-0417-NETSCAN
Date: 2026-04-17
Status: ACTIVE
Analyst: Breakglass Intelligence
Source Credit: @JustWantToQ1 (Voidwalker) -- initial tip

Executive Summary

NET_SCAN is a fully operational cybercrime-as-a-service (CaaS) platform operated by the actor xssNew (XSS.is forum, Premium member since July 2022). The platform consists of two interconnected web applications: netscan[.]info, the full-featured CaaS panel offering WordPress exploitation, remote shell access, SMS fraud, email spoofing, credential theft, and cryptomining deployment; and wpmagic[.]net, a spinoff panel branded "WP Magic Button" that focuses specifically on WordPress mass credential checking and code injection.

Both domains share a single Cloudflare account (NS pair: elias.ns.cloudflare.com / rita.ns.cloudflare.com), confirming common ownership. The operator communicates in Russian natively and maintains Telegram infrastructure under the handle @NET_SCAN_Admin.

Critical findings include unauthenticated API endpoints on netscan[.]info leaking 29 stolen SMS provider credentials, 18,862 stolen SMTP credentials, 104 exposed databases, and a full cryptominer deployment script with C2 configuration. The miner binary is not present in VirusTotal as of the investigation date.

The concept for the WordPress injection toolkit was stolen from security researcher Voidwalker (@JustWantToQ1), who publicly called out the theft on Twitter on April 15, 2026.

Actor Profile

AttributeValue
Forum HandlexssNew
ForumXSS.is (Premium member)
JoinedJuly 21, 2022
Messages46
Telegram@NET_SCAN_Admin ("Founder and technical lead of the NET_SCAN project")
Bots@NET_SCAN_bot (ScanBot), @netscan_bot
Private Channelt.me/+aikcAM_CK5NlZWRk
LanguageRussian (native) -- 100+ Cyrillic UI strings in source; English, Spanish, Chinese translations
PaymentUSDT TRC20 to TEcji7HtrDfc1kjTCWe7C6BzXzR7DTxoUX (wallet empty/fresh at time of investigation)

The actor advertised "Magic Button - Project from the Net Scan" on XSS.is, offering WordPress credential checking and code injection as a service at three pricing tiers: $100, $300, and $500.

Infrastructure: wpmagic.net

Domain: wpmagic[.]net
Registrar: Ultahost Inc (registered 2026-04-10, WHOIS proxy claims New York, US)
Stack: Vue.js frontend + Express/Node.js backend behind Cloudflare
Certificate: Let's Encrypt E8, wildcard *.wpmagic.net, issued April 10, 2026
IPs (Cloudflare): 104.21.79.221, 172.67.171.145

Registration & Access

The platform offers open registration. During the investigation, account ghostrecon_1776388805 was created (assigned user ID 16). At the time of registration, only three prior accounts existed: admin, test, and test1 -- indicating the platform was freshly launched with minimal adoption.

The admin account was found to be disabled, likely locked by the operator after early Twitter exposure.

Core Functionality

WP Magic Button provides a WordPress mass exploitation workflow:

  1. Credential Checking -- Bulk verification of WordPress login credentials against target sites
  2. Four Injection Methods:
    • Theme Editor (TE_INJECTED) -- Modifies active theme functions.php
    • File Manager (FM_INJECTED) -- Uses File Manager plugin for file upload/modification
    • Plugin Editor (PE_INJECTED) -- Edits existing plugin source code
    • Plugin Loading (PU_INJECTED) -- Uploads and activates a malicious plugin
  3. Campaign System -- Multi-threaded campaigns with configurable timeouts, proxy support, and custom injection scripts
  4. Result Classification -- Sites categorized as Good, Injected, NoPlugin, or Bad
  5. Clone Missed -- Retry feature for failed injection attempts

Available variables in injection scripts: $site_url, $username, $password

Pricing Model

Payment is handled through the /api/user/pay/init endpoint:

TierPrice
Basic$100
Standard$300
Premium$500

All payments accepted in USDT (TRC20) to wallet TEcji7HtrDfc1kjTCWe7C6BzXzR7DTxoUX.

The connection to netscan[.]info was established through hardcoded artifacts in the wpmagic[.]net dashboard source code:

  • Comment references to //t.me/NET_SCAN_Admin
  • Comment references to //netscan.info/
  • Sidebar banner element linking directly to netscan[.]info
  • Identical Cloudflare NS pair (elias + rita) confirming same account

Infrastructure: netscan.info

Domain: netscan[.]info
Stack: 3MB React application bundle + Node.js backend behind Cloudflare
IPs (Cloudflare): 104.21.91.253, 172.67.183.109

The parent platform is a comprehensive cybercrime-as-a-service offering with far greater capability than the wpmagic[.]net spinoff. Analysis of the React application bundle and API endpoint enumeration revealed the following modules:

Module Inventory

ModuleAPI PathCapability
jQuery Changer/api/jquery-changer/*WordPress mass injection (the "Magic Button" module)
Remote Shell/api/shell, /api/exec/runExecute commands on compromised hosts
AWS Credential Theft/api/credentials/aws/*Harvest and validate AWS credentials
cPanel/SSH Access/api/security/cpanel-access, /api/security/ssh-accessSteal cPanel and SSH credentials
Sensitive File Scanner/api/sensitive-scan/*Discover databases and sensitive files on hosts
Database Operations/api/dbDirect database manipulation
Email Database Extraction/api/security/db-email/*Extract email databases from compromised hosts
Email Spoofing/api/plugins/email-spoof/*SMTP-based email spoofing
SMS Fraud/api/sms/*Send SMS, manage numbers, track provider stats
Bulk Email Campaigns/api/mail/campaign/sendMass email distribution
AI Phishing Emails/api/email/ai-generateLLM-generated phishing content
AI Assistant (Luna)/admin/ai-chat/streamOperator AI assistant
Crypto Mining/api/miners/*XMRig deployment and management
Telegram Automation/api/plugins/telegram-autoreply/*Automated Telegram bot responses
WhatsApp Automation/api/plugins/whatsapp-autoreply/*Automated WhatsApp responses
Telerik Exploit Builder/api/telerik/build-dllCVE exploit DLL generation for Telerik
Text-to-Speech/api/tts/speakVoice synthesis for vishing attacks
Referral System/api/ref/invite, /api/ref/trackAffiliate tracking for customer acquisition

AI Integration

The platform integrates multiple LLM providers under the internal name "Luna":

  • Groq -- llama-3.1-8b, llama-3.3-70b
  • OpenAI -- GPT models
  • Anthropic -- Claude models
  • Google -- Gemini models

This AI layer is used for phishing email generation and operator assistance.

Credential Artifact

The production JavaScript bundle contains the hardcoded credential artifact @ssw0rd123!, likely a default or development password that was not stripped before deployment.

Unauthenticated Data Leaks

Multiple API endpoints on netscan[.]info return sensitive operational data without requiring any authentication. These represent both intelligence opportunities and indicators of the operator's poor security practices.

1. Stolen SMS Provider Credentials

Endpoint: /api/sms/credentials
Exposed: 29 stolen Twilio, Vonage, and MSG91 API credentials with full Account SIDs

Affected organizations include:

OrganizationDomainSector
HealthUB Africamyhealth-dev.healthubafrica.comHealthcare (Africa)
Neptik Authenticatorapi.authenticator.neptik.comAuthentication services
PillPharmapi.pillpharm.co.ukPharmacy (UK)
PTPSptps.com.pkOrganization (Pakistan)
ePalengke LGUepalengke-admin.lguapps.comGovernment (Philippines)
DeliveryMaxdeliverymax.co.ukDelivery services (UK)
Vine Healthcareportal.vinehealthcareservices.comHealthcare
+ 22 more--Various sectors

2. SMS Provider Statistics

Endpoint: /api/sms/providers/stats

ProviderTotal CredentialsValid
Twilio69058
Vonage7010
MSG912410
Infobip----
Plivo----
BulkSMS----

3. Exposed Database Inventory

Endpoint: /api/sensitive-scan/databases
Exposed: 104 databases discovered by the platform's scanning operations

  • 100 MongoDB instances
  • 4 PostgreSQL instances
  • Targets include universities, AI companies, fintech platforms, and e-commerce sites

4. Stolen Email Credentials

Endpoint: /api/mail/providers/stats

TypeTotalValidated
SMTP credentials18,862942
SendGrid API keys53643
Mailgun API keys22716
Resend API keys21752

5. Miner Installation Script

Endpoint: /api/miners/agent/install.sh
Full deployment script exposed (see Cryptominer Deployment section).

6. Scanner Operational Data

Endpoints: /api/sensitive-scan/status, /api/sensitive-scan/logs
Real-time scanner session status and historical scan logs exposed without authentication.

Cryptominer Deployment

The platform deploys a custom cryptomining agent to compromised hosts. The full installation script was recovered from the unauthenticated endpoint /api/miners/agent/install.sh.

Architecture

ComponentDetail
Agent Binarymultimmm-user (custom Go binary)
MinerXMRig (Monero)
C2 ProtocolWebSocket (wss://netscan.info/api/miners/ws/agent)
Persistencesystemd service (multimmm-user.service), auto-restart on failure
Agent SHA2560a1c301ddbf20dfdf4cd5905f1bba8ffea85c94af2849971c9701472ff059e1c
XMRig SHA2561821cfbf97c531534a9c11dc30f5f1dc1b32071ab5d5d7326767ee9607d5e907

API Keys (Embedded in Install Script)

6ae42b2642631533e1e65ba7cdc95cad0f9d9206b787ca1f2ca48a8d5d18f3d7
0d4c7e56d15d920592dd93ba35d18bd08d102951d6039ff219710f0c29c72ff0

VirusTotal Status

The multimmm-user agent binary hash (0a1c301d...) was not found in VirusTotal at the time of investigation, indicating this is a custom or newly compiled binary without prior detection coverage.

Stolen Concept Attribution

On April 15, 2026, Twitter user @JustWantToQ1 (known as Voidwalker) publicly accused the NET_SCAN operator of stealing their concept:

"someone just took my idea of making a js inject exploit kit for mass spreading clickflix campaigns and started selling it for bullshit '100$ - 300$ - 500$' packages after running it through an AI"

Voidwalker then directly linked to https://wpmagic[.]net/login, adding:

"I hope your service and all your customers get rekt just because"

This public callout is what led to the initial discovery and investigation of the wpmagic[.]net platform. The AI-generated nature of the code is supported by the codebase characteristics observed during analysis.

Vulnerabilities Found

Five security weaknesses were identified in the wpmagic[.]net platform during investigation:

#VulnerabilitySeverityDetail
1Password Change Without VerificationHighPOST /api/user/password does not require the current password
2Authorization Bypass on Proxy ListsMediumProxy list creation at /api/proxy bypasses subscription tier checks
3Missing CORS HeadersMediumNo CORS policy enables cross-site request forgery
4Weak Session SecurityMedium64-char hex SHA-256 session cookie lacks Secure flag
5Internal Service ExposureLowFlareSolverr internal URL (http://flaresolverr:8191) leaked via /api/flaresolverr

Indicators of Compromise

Network Indicators

TypeIndicatorContext
Domainwpmagic[.]netWordPress injection panel
Domainnetscan[.]infoFull CaaS platform
IPv4104.21.79.221wpmagic[.]net (Cloudflare)
IPv4172.67.171.145wpmagic[.]net (Cloudflare)
IPv4104.21.91.253netscan[.]info (Cloudflare)
IPv4172.67.183.109netscan[.]info (Cloudflare)
URLwss://netscan[.]info/api/miners/ws/agentMiner C2 WebSocket
URLhttp://flaresolverr:8191Internal CAPTCHA solver

Host Indicators

TypeIndicatorContext
SHA2560a1c301ddbf20dfdf4cd5905f1bba8ffea85c94af2849971c9701472ff059e1cmultimmm-user agent binary
SHA2561821cfbf97c531534a9c11dc30f5f1dc1b32071ab5d5d7326767ee9607d5e907Bundled XMRig binary
Service Namemultimmm-usersystemd persistence service
Process Namemultimmm-userAgent process
API Key6ae42b2642631533e1e65ba7cdc95cad0f9d9206b787ca1f2ca48a8d5d18f3d7Miner agent key
API Key0d4c7e56d15d920592dd93ba35d18bd08d102951d6039ff219710f0c29c72ff0Miner agent key
Credential@ssw0rd123!Hardcoded in production bundle

Actor Indicators

TypeIndicatorContext
Telegram@NET_SCAN_AdminOperator account
Telegram@NET_SCAN_botScanBot
Telegram@netscan_botSecondary bot
Telegramt.me/+aikcAM_CK5NlZWRkPrivate channel invite
ForumxssNew (XSS.is)Premium member, 46 messages
WalletTEcji7HtrDfc1kjTCWe7C6BzXzR7DTxoUXUSDT TRC20 payment

Certificate Indicators

DomainIssuerNote
*.wpmagic.netLet's Encrypt E8Wildcard, issued April 10, 2026
netscan.infoCloudflareBehind Cloudflare proxy

Cloudflare NS Pair (Shared Account)

  • elias.ns.cloudflare.com
  • rita.ns.cloudflare.com

MITRE ATT&CK Mapping

Technique IDNamePlatform Usage
T1190Exploit Public-Facing ApplicationWordPress credential brute-force and injection
T1059.004Command and Scripting Interpreter: Unix ShellRemote shell module (/api/shell, /api/exec/run)
T1552.001Unsecured Credentials: Credentials in FilesSMS API key harvesting, SMTP credential theft
T1496Resource HijackingXMRig cryptominer deployment
T1583.001Acquire Infrastructure: Domainswpmagic[.]net, netscan[.]info
T1583.006Acquire Infrastructure: Web ServicesCloudflare CDN and Workers
T1588.002Obtain Capabilities: ToolStole Voidwalker's concept, AI-generated code
T1566.002Phishing: Spearphishing LinkEmail spoofing module with AI-generated content
T1078Valid AccountsWordPress credential checking and reuse
T1505.003Server Software Component: Web ShellPHP injection into WordPress themes/plugins
T1053.003Scheduled Task/Job: SystemdMiner persistence via systemd service
T1027Obfuscated Files or InformationPacked/stripped miner binary
T1071.001Application Layer Protocol: Web ProtocolsWebSocket C2 channel for miner
T1048Exfiltration Over Alternative ProtocolSMS credential exfiltration via stolen API keys

Detection Signatures

Suricata / Snort

alert http $HOME_NET any -> any any (msg:"NetScan Miner Agent Install"; content:"multimmm-user"; http_uri; sid:2026041710; rev:1;)
alert http $HOME_NET any -> any any (msg:"NetScan Miner WebSocket C2"; content:"netscan.info/api/miners/ws/agent"; sid:2026041711; rev:1;)
alert http $HOME_NET any -> any any (msg:"NetScan jQuery Changer Injection"; content:"jquery-changer"; http_uri; sid:2026041712; rev:1;)
alert dns $HOME_NET any -> any any (msg:"NetScan CaaS Domain"; dns.query; content:"netscan.info"; sid:2026041713; rev:1;)
alert dns $HOME_NET any -> any any (msg:"WPMagic Panel Domain"; dns.query; content:"wpmagic.net"; sid:2026041714; rev:1;)

Splunk Queries

index=proxy (dest_host="netscan.info" OR dest_host="wpmagic.net")
| stats count by src_ip, dest_host, uri_path

index=sysmon EventCode=1 (CommandLine="*multimmm-user*" OR CommandLine="*xmrig*")
| table _time, Computer, User, CommandLine, ParentCommandLine

index=linux sourcetype=syslog "multimmm-user" OR "systemctl.*multimmm"

YARA Rules

rule NetScan_Miner_Agent {
    meta:
        description = "NetScan CaaS custom crypto miner agent"
        author = "Breakglass Intelligence"
        date = "2026-04-17"
        tlp = "AMBER"
        reference = "GHOST-2026-0417-NETSCAN"
    strings:
        $s1 = "multimmm-user" ascii
        $s2 = "netscan.info/api/miners" ascii
        $s3 = "6ae42b2642631533e1e65ba7cdc95cad" ascii
        $s4 = "0d4c7e56d15d920592dd93ba35d18bd0" ascii
    condition:
        uint32(0) == 0x464c457f and any of them
}

rule WPMagic_Injection_Marker {
    meta:
        description = "WP Magic Button WordPress injection markers"
        author = "Breakglass Intelligence"
        date = "2026-04-17"
        tlp = "AMBER"
        reference = "GHOST-2026-0417-NETSCAN"
    strings:
        $te = "TE_INJECTED" ascii
        $fm = "FM_INJECTED" ascii
        $pe = "PE_INJECTED" ascii
        $pu = "PU_INJECTED" ascii
        $wp = "wpmagic" ascii nocase
        $ns = "netscan" ascii nocase
    condition:
        any of them
}

rule NetScan_FlareSolverr_Config {
    meta:
        description = "NetScan platform FlareSolverr configuration leak"
        author = "Breakglass Intelligence"
        date = "2026-04-17"
        tlp = "AMBER"
        reference = "GHOST-2026-0417-NETSCAN"
    strings:
        $fs = "flaresolverr:8191" ascii
        $ns = "netscan" ascii nocase
    condition:
        all of them
}

Recommendations

Immediate Actions

  1. DNS/Proxy Blocking -- Block netscan[.]info and wpmagic[.]net at all DNS resolvers, web proxies, and firewall appliances.

  2. Host Hunting -- Search all Linux hosts for the multimmm-user systemd service and any running xmrig processes. Check for the service file at /etc/systemd/system/multimmm-user.service.

  3. WordPress Audit -- All WordPress administrators should:

    • Inspect functions.php in the active theme for unauthorized modifications
    • Review the installed plugin list for unknown or recently added plugins
    • Check File Manager plugin activity logs for suspicious file operations
    • Rotate all WordPress admin credentials

Notification Actions

  1. SMS Provider Notification -- The 29 stolen API credentials (Twilio, Vonage, MSG91) should be reported to the respective providers for immediate revocation. Affected organizations (HealthUB Africa, PillPharm, ePalengke LGU, and others) should be notified.

  2. Database Exposure Notification -- The 104 exposed databases (primarily MongoDB) identified by the platform's scanner should be reported to their respective operators.

  3. Cloudflare Abuse Report -- File an abuse report with Cloudflare for both domains, noting they share a single account (NS pair: elias + rita) and are used for active cybercrime operations.

Law Enforcement

  1. Forum Actor Reporting -- Report xssNew (XSS.is Premium member, joined July 2022, 46 messages) to FBI IC3 and Europol EC3 with full IOC package.

  2. Wallet Monitoring -- Monitor USDT TRC20 wallet TEcji7HtrDfc1kjTCWe7C6BzXzR7DTxoUX for cashout transactions that may reveal exchange accounts or additional infrastructure.

Investigation Files

FileDescription
README.mdThis investigation report
CLIENT_REPORT.htmlClient-ready HTML report
iocs.csvMachine-readable IOC list
yara_rules.yarYARA detection rules
stix_bundle.jsonSTIX 2.1 threat intelligence bundle

Timeline

DateEvent
2022-07-21xssNew joins XSS.is forum (Premium member)
2026-04-10wpmagic[.]net domain registered via Ultahost Inc
2026-04-10Let's Encrypt wildcard certificate issued for *.wpmagic.net
2026-04-15@JustWantToQ1 (Voidwalker) publicly accuses NET_SCAN of stealing concept
2026-04-15Voidwalker links to wpmagic[.]net login page on Twitter
2026-04-16Investigation initiated by Breakglass Intelligence
2026-04-17Full platform analysis completed, unauthenticated leaks documented
2026-04-17Report generated

Methodology

This investigation followed the GHOST offensive intelligence methodology:

  1. Initial Tip -- Voidwalker's Twitter callout identified wpmagic[.]net
  2. Open Registration -- Account created on wpmagic[.]net to assess platform capabilities
  3. Source Code Analysis -- Vue.js/React bundles analyzed for hardcoded references and API endpoints
  4. Infrastructure Pivoting -- wpmagic[.]net source comments led to netscan[.]info discovery
  5. DNS Correlation -- Shared Cloudflare NS pair confirmed single-operator infrastructure
  6. API Enumeration -- Systematic testing of discovered endpoints revealed unauthenticated data leaks
  7. Artifact Collection -- Miner binaries, API keys, stolen credentials, and forum posts documented
  8. IOC Generation -- Network, host, and actor indicators compiled for defensive use

Investigation by Breakglass Intelligence.
Report generated: 2026-04-17
GHOST-2026-0417-NETSCAN

Share