ILSpy WordPress Compromised: Malware Delivered via Supply Chain Attack

Key Takeaways

• A supply chain attack targeted developers through the official ILSpy WordPress website.
• Threat actors compromised the site to redirect users to a malicious page delivering a browser extension.
• The malicious extension functions as spyware, capable of stealing credentials and monitoring web traffic.
• The compromised website has been taken offline, preventing further infections.

ILSpy WordPress Compromised in Developer-Targeted Supply Chain Attack

On April 6, 2026, the official WordPress domain for ILSpy, a popular .NET decompiler, fell victim to a supply chain attack. Instead of providing legitimate software downloads, the hijacked website began redirecting visitors to a malicious page designed to deliver malware, specifically targeting developers.

Typically, the download button on the ILSpy website directs users to the project’s official GitHub repository. However, during the compromise, attackers altered the underlying links, rerouting users seeking the developer tool to an unauthorized third-party domain.

Upon landing on this deceptive page, visitors were prompted to install a specific browser extension, presented as a prerequisite to continue their download. This tactic exploits the inherent trust developers place in official project domains, leading them to bypass standard security precautions.

The Dangers of Malicious Browser Extensions

While browser extensions might appear less threatening than traditional executable files, they pose significant security risks. Once installed, malicious extensions can operate as potent spyware, stealthily stealing session cookies, capturing typed passwords, and monitoring web traffic.

For software developers, such a compromise could expose sensitive corporate assets, including proprietary source code, internal network access, or cloud infrastructure credentials, to remote threat actors.

Independent security researcher RootSuccess initially documented the attack on video and reported it to vx-underground, which subsequently issued a public alert around 1:22 AM EST.

Following widespread attention on social media, the compromised ILSpy WordPress site was taken offline. Currently, the domain displays a 502 Bad Gateway error, effectively halting further potential infections.

Security researchers are actively analyzing the malicious browser extension to identify Indicators of Compromise (IoCs) and fully understand the payload’s technical capabilities and scope.

Escalating Threat Landscape for Developers

This incident underscores a growing trend in the cybersecurity landscape where developers are increasingly becoming primary targets. While much of the security community’s focus often lies on risks like poisoned npm packages or malicious Python libraries, this attack demonstrates that traditional web vulnerabilities remain highly effective entry points.

A seemingly simple WordPress compromise allowed attackers to intercept the software supply chain at a critical point—the download phase. Security experts note that exploiting content management systems to establish redirect chains is an older tactic. However, its combination with trusted developer tools creates a highly effective and dangerous trap, often referred to as a watering hole attack.

What You Should Do

• Always verify the final URL in your browser’s address bar before initiating any software download.
• Never install unexpected browser extensions, especially if a website claims they are “required” to download a standard file or application.
• Bookmark and download developer tools directly from official, verified source code repositories like GitHub whenever possible, rather than relying on third-party sites.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.