Rogue WordPress admin account created with wp2shell naming prefix

Emiliano Mema@Nosalva

•updated Jul 22, 2026•2•0•5

Detects the creation of user accounts or identity updates that utilize naming conventions or email domains associated with 'wp2shell' malicious activity patterns. This is commonly used in WordPress exploitation scenarios to establish persistent unauthorized administrative access.