The malware can recreate hidden backdoors when a site is visited. It may also plant PHP backdoors, create rogue admin accounts, add scheduled tasks and SSH keys, and expose credentials. Affected Rank Math PRO downloads and updates were distributed from October 15, 20:02 UTC to October 16, 07:12 UTC. Sites that installed and activated those copies should be treated as compromised. Earlier 3.0.123 installs are outside the affected window.

Official respond from crypto bilis former co-founder / owner

If you’re gonna use a hardware wallet, buy directly from the manufacturer, not a reseller. Ship to a P.O. Box, install verified firmware from the official site before use, and generate your own entropy with properly rolled dice instead of blindly trusting seeds from the device.

🚨 DarkSword's new P7 iOS variant goes beyond data theft. Its implant can extract iCloud Keychain and crypto wallet data, execute attacker commands, and poll for new commands every 15 seconds. Details: thehackernews.com/2026/10/p7…

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses. Reach out to Ledger customer support through official channels with any questions: support.ledger.com/