BuddyBoss updates backdoored WordPress sites

BuddyBoss was compromised at the update pipeline, not at each customer site. The attacker already had access to BuddyBoss GitHub organization resources before the public timeline begins. A malicious GitHub Actions workflow ran under a legitimate developer identity and exfiltrated runner tokens, SSH keys, application secrets, and the Caseproof Mothership API key.

Those secrets opened the publishing path. The attacker used SSH access to BuddyBoss infrastructure, reached root on an AWS publishing server, and used the appcenter_key to talk to the Caseproof licensing system at licenses.caseproof.com. Cloudflare blocked the large multipart upload, so the attacker found the Heroku origin behind Cloudflare and uploaded directly with the correct Host header.

The malicious artifacts were normal-looking BuddyBoss updates. BuddyBoss Platform was published as version 2.20.3, with later reporting showing a malicious 2.20.4 as well. BuddyBoss Theme was published as 2.19.2. Each package changed one core PHP file: bp-loader.php in the platform plugin and functions.php in the theme.

The backdoors stole WordPress database credentials, secret keys, environment variables, plugin lists, user counts, and server data. They also exposed command execution, file read, reverse shell, and later standalone webshell paths. Ctrl-Alt-Intel recovered C2 logs from 246 or more victim sites; Cybernews reported 309 compromised sites and live Stripe keys among the stolen data.

Motive

Credential Theft

Cause

Compromised Credentials

Transitive

No

Actor

Unknown French-speaking attacker

User Impact

309

• BuddyBoss platform compromised, hundreds of websites already hackedcybernews.com
• The BuddyBoss Attack: Claude's Supply-Chain Attackctrlaltintel.com
• The BuddyBoss Attack: Full Incident Analysisctrlaltintel.com
• BuddyBoss Platform Compromised as Hundreds of Websites Are Hackedsecurityboulevard.com
• BuddyBoss supply chain attackthreats.wiz.io