Zscaler has discovered a number of WordPress sites that have been backdoored and sending credentials to a hacker-controlled website.