Compromised cPanel access fuels underground cybercrime market

Compromised cPanel credentials are being openly advertised and sold in large quantities across underground chat groups, functioning as a readily available infrastructure for threat actors. These credentials are marketed as a plug-and-play solution for launching phishing and scam campaigns, as well as other malicious activities. This trend highlights a structured and scaled ecosystem operating within the cybercriminal underground, as reported by Bleeping Computer.

cPanel, a widely used Linux-based web hosting control panel, provides attackers with extensive control over websites. With over 1.5 million internet-connected servers running cPanel, its compromise allows threat actors to deploy backdoors, create new admin users, install malware, gain root access, and even launch phishing kits or spam campaigns using legitimate domain names. The use of valid credentials makes detection difficult for traditional security measures. Attackers gain access through stolen or brute-forced credentials, often exploiting weak passwords, password reuse from data breaches, or vulnerabilities in websites hosted on the same server. The commoditized market sees cPanel access sold in bulk, with pricing tiers reflecting quality, geography, and infrastructure reputation, often advertised with terms like "fresh" or "ready for mailing."

The increasing trade of compromised cPanel credentials transforms them into a high-value commodity, shifting the cybercrime economy towards access brokerage. This industrializes the model, lowering the barrier for phishing operators seeking trusted domains and IP space. Organizations must prioritize enabling multi-factor authentication, enforcing strong passwords, and restricting access. Continuous monitoring of outbound SMTP activity and file integrity, alongside timely patching of CMS platforms and plugins, are crucial mitigation steps to prevent these compromised accounts from becoming strategic assets in widespread cybercriminal operations.

Source: Bleeping Computer